Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64110

seladb · Nov 12, 2023 · 05001ca · 05001ca
1 parent 0c95dfb
commit 05001ca
Show file tree

Hide file tree

Showing 3 changed files with 36 additions and 4 deletions.
diff --git a/Packet++/header/GreLayer.h b/Packet++/header/GreLayer.h
@@ -276,6 +276,16 @@ namespace pcpp
 		 */
 		bool unsetKey();
 
+		/**
+		 * A static method that validates the input data
+		 * @param[in] data The pointer to the beginning of a byte stream of an GREv0 layer
+		 * @param[in] dataLen The length of the byte stream
+		 * @return True if the data is valid and can represent an GREv0 layer
+		 */
+		static inline bool isDataValid(const uint8_t* data, size_t dataLen)
+		{
+			return data && dataLen >= sizeof(gre_basic_header);
+		}
 
 		// implement abstract methods
 
@@ -350,6 +360,16 @@ namespace pcpp
 		 */
 		bool unsetAcknowledgmentNum();
 
+		/**
+		 * A static method that validates the input data
+		 * @param[in] data The pointer to the beginning of a byte stream of an GREv1 layer
+		 * @param[in] dataLen The length of the byte stream
+		 * @return True if the data is valid and can represent an GREv1 layer
+		 */
+		static inline bool isDataValid(const uint8_t* data, size_t dataLen)
+		{
+			return data && dataLen >= sizeof(gre1_header);
+		}
 
 		// implement abstract methods
 

diff --git a/Packet++/src/IPv4Layer.cpp b/Packet++/src/IPv4Layer.cpp
@@ -290,9 +290,15 @@ void IPv4Layer::parseNextLayer()
 	case PACKETPP_IPPROTO_GRE:
 		greVer = GreLayer::getGREVersion(payload, payloadLen);
 		if (greVer == GREv0)
-			m_NextLayer = new GREv0Layer(payload, payloadLen, this, m_Packet);
+		{
+			if (GREv0Layer::isDataValid(payload, payloadLen))
+				m_NextLayer = new GREv0Layer(payload, payloadLen, this, m_Packet);
+		}
 		else if (greVer == GREv1)
-			m_NextLayer = new GREv1Layer(payload, payloadLen, this, m_Packet);
+		{
+			if (GREv1Layer::isDataValid(payload, payloadLen))
+				m_NextLayer = new GREv1Layer(payload, payloadLen, this, m_Packet);
+		}
 		else
 			m_NextLayer = new PayloadLayer(payload, payloadLen, this, m_Packet);
 		break;

diff --git a/Packet++/src/IPv6Layer.cpp b/Packet++/src/IPv6Layer.cpp
@@ -242,9 +242,15 @@ void IPv6Layer::parseNextLayer()
 	{
 		ProtocolType greVer = GreLayer::getGREVersion(payload, payloadLen);
 		if (greVer == GREv0)
-			m_NextLayer = new GREv0Layer(payload, payloadLen, this, m_Packet);
+		{
+			if (GREv0Layer::isDataValid(payload, payloadLen))
+				m_NextLayer = new GREv0Layer(payload, payloadLen, this, m_Packet);
+		}
 		else if (greVer == GREv1)
-			m_NextLayer = new GREv1Layer(payload, payloadLen, this, m_Packet);
+		{
+			if (GREv1Layer::isDataValid(payload, payloadLen))
+				m_NextLayer = new GREv1Layer(payload, payloadLen, this, m_Packet);
+		}
 		else
 			m_NextLayer = new PayloadLayer(payload, payloadLen, this, m_Packet);
 		break;