FW: [PATCH]Possible bug in libnet_build_udp.c in libnet 1.1.2.1and its fix

This is a multi-part message in MIME format.

------_=_NextPart_001_01C54F39.82C7B164
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Resending ...=20

-----Original Message-----
From: Arun Vishwanathan=20
Sent: Sunday, April 24, 2005 1:28 AM
To: '[email protected]'
Subject: [PATCH]Possible bug in libnet_build_udp.c in libnet 1.1.2.1and
its fix


Hi Mike,=20

I encountered a possible bug while using libnet_build_udp
(libnet-1.1.2.1) function. I wanted to craft packets to simulate a UDP
datagram being split into multiple IP fragments.=20

The following function is called first time in my code to build the
first fragment with the UDP header and the subsequent fragments are
built using libnet_build_ipv4.=20

      udp =3D libnet_build_udp(
           p->sport,                            /* source port */
           p->dport,                            /* destination port */
           LIBNET_UDP_H + totlen,               /* packet length */
           0,                                   /* checksum */
           p->payload,                          /* payload */
           p->length,                           /* payload size */
           l,                                   /* libnet handle */
           udp);                                /* libnet id */
       if (udp =3D=3D -1) {
          err =3D libnet_geterror(l);
          retval =3D ERR_BUILD_UDP;
          goto bad;
       }

In the above function I gave "packet length" as the full UDP datagram
length (unfragmented) and the payload size as the size of the payload in
*this*  packet. But this code produced seg fault in the libnet
checksumming function.=20

A close look at the code in libnet_build_udp.c revealed the problem.=20

Line55:     n =3D LIBNET_UDP_H + payload_s;       /* size of memory =
block
*/
Line56:     h =3D len;               /* header length (for cksum) */
Line105:    return (ptag ? ptag : libnet_pblock_update(l, p, h,
LIBNET_PBLOCK_UDP_H));

On line 105 "h" is passed to the called which is subsequently used for
checksum calculation. But actually it is "n" that should be passed
because checksum should be pa.=20

After making this change the segfaults did not occur and my code worked
:)

I have rectified the mistake and created a patch. The patch adds proper
comments to line 55 and 56 and updates line 105. I hope my thinking is
right. Please let me know in any case.=20

Please find attached the patch with this mail.

Regards,
Arun=20

-------------------------------------------------------------
"Using encryption on the Internet is the equivalent of arranging
 an armored car to deliver credit-card information from someone=20
 living in a cardboard box to someone living on a park bench."
                                         -Gene Spafford  =20
-------------------------------------------------------------


------_=_NextPart_001_01C54F39.82C7B164
Content-Type: application/octet-stream;
	name="libnet-udp-cksum-fix-arunv.patch"
Content-Transfer-Encoding: base64
Content-Description: libnet-udp-cksum-fix-arunv.patch
Content-Disposition: attachment;
	filename="libnet-udp-cksum-fix-arunv.patch"

Q29tbW9uIHN1YmRpcmVjdG9yaWVzOiBsaWJuZXQvc3JjL0NWUyBhbmQgbGlibmV0Lm5ldy9zcmMv
Q1ZTCmRpZmYgLXVwIGxpYm5ldC9zcmMvbGlibmV0X2J1aWxkX3VkcC5jIGxpYm5ldC5uZXcvc3Jj
L2xpYm5ldF9idWlsZF91ZHAuYwotLS0gbGlibmV0L3NyYy9saWJuZXRfYnVpbGRfdWRwLmMJMjAw
NC0wMS0yMiAwMDozMTozMC4wMDAwMDAwMDAgKzA1MzAKKysrIGxpYm5ldC5uZXcvc3JjL2xpYm5l
dF9idWlsZF91ZHAuYwkyMDA1LTA0LTI0IDAxOjAwOjQ0LjAwMDAwMDAwMCArMDUzMApAQCAtNTIs
OCArNTIsOSBAQCB1X2ludDhfdCAqcGF5bG9hZCwgdV9pbnQzMl90IHBheWxvYWRfcywgCiAgICAg
ICAgIHJldHVybiAoLTEpOwogICAgIH0gCiAKLSAgICBuID0gTElCTkVUX1VEUF9IICsgcGF5bG9h
ZF9zOyAgICAgICAgICAgICAgIC8qIHNpemUgb2YgbWVtb3J5IGJsb2NrICovCi0gICAgaCA9IGxl
bjsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvKiBoZWFkZXIgbGVuZ3RoIChm
b3IgY2tzdW0pICovCisgICAgbiA9IExJQk5FVF9VRFBfSCArIHBheWxvYWRfczsgICAgICAgICAg
ICAgICAvKiBzaXplIG9mIG1lbW9yeSBibG9jay4gQWxzbyB1c2VkCisgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0byBjYWxjdWxhdGUgY2hlY2tzdW0g
Ki8KKyAgICBoID0gbGVuOyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC8qIFRv
dGFsIGxlbmd0aCBvZiBVRFAgZGF0YWdyYW0gKi8KIAogICAgIC8qCiAgICAgICogIEZpbmQgdGhl
IGV4aXN0aW5nIHByb3RvY29sIGJsb2NrIGlmIGEgcHRhZyBpcyBzcGVjaWZpZWQsIG9yIGNyZWF0
ZQpAQCAtMTAyLDcgKzEwMyw4IEBAIHVfaW50OF90ICpwYXlsb2FkLCB1X2ludDMyX3QgcGF5bG9h
ZF9zLCAKICAgICAgICAgICovCiAgICAgICAgIGxpYm5ldF9wYmxvY2tfc2V0ZmxhZ3MocCwgTElC
TkVUX1BCTE9DS19ET19DSEVDS1NVTSk7CiAgICAgfQotICAgIHJldHVybiAocHRhZyA/IHB0YWcg
OiBsaWJuZXRfcGJsb2NrX3VwZGF0ZShsLCBwLCBoLCBMSUJORVRfUEJMT0NLX1VEUF9IKSk7CisK
KyAgICByZXR1cm4gKHB0YWcgPyBwdGFnIDogbGlibmV0X3BibG9ja191cGRhdGUobCwgcCwgbiwg
TElCTkVUX1BCTE9DS19VRFBfSCkpOwogYmFkOgogICAgIGxpYm5ldF9wYmxvY2tfZGVsZXRlKGws
IHApOwogICAgIHJldHVybiAoLTEpOwpPbmx5IGluIGxpYm5ldC5uZXcvc3JjOiBNYWtlZmlsZQpP
bmx5IGluIGxpYm5ldC5uZXcvc3JjOiBXfjQjCg==

------_=_NextPart_001_01C54F39.82C7B164--