diff --git a/checksum.c b/checksum.c index c50250829..e71335896 100644 --- a/checksum.c +++ b/checksum.c @@ -110,9 +110,9 @@ create_osi_cksum (const uint8_t *pptr, int checksum_offset, int length) int x; int y; - uint32_t mul; + int32_t mul; uint32_t c0; - uint32_t c1; + uint64_t c1; uint16_t checksum; int idx; @@ -138,18 +138,20 @@ create_osi_cksum (const uint8_t *pptr, int checksum_offset, int length) mul = (length - checksum_offset)*(c0); - x = mul - c0 - c1; - y = c1 - mul - 1; - - if ( y >= 0 ) y++; - if ( x < 0 ) x--; + /* + * Casting c0 and c1 here is guaranteed to be safe, because we know + * they have values between 0 and 254 inclusive. These casts are + * done to ensure that all of the arithmetic operations are + * well-defined (i.e., not mixing signed and unsigned integers). + */ + x = mul - (int)c0 - (int)c1; + y = (int)c1 - mul; x %= 255; y %= 255; - - if (x == 0) x = 255; - if (y == 0) y = 255; + if (x <= 0) x += 255; + if (y <= 0) y += 255; y &= 0x00FF; checksum = ((x << 8) | y); diff --git a/print-bgp.c b/print-bgp.c index c4c79b2d5..e4cb3da0e 100644 --- a/print-bgp.c +++ b/print-bgp.c @@ -1268,6 +1268,8 @@ decode_multicast_vpn(netdissect_options *ndo, switch(route_type) { case BGP_MULTICAST_VPN_ROUTE_TYPE_INTRA_AS_I_PMSI: ND_TCHECK_LEN(pptr, BGP_VPN_RD_LEN); + if (route_length < BGP_VPN_RD_LEN) + goto trunc; offset = (u_int)strlen(buf); snprintf(buf + offset, buflen - offset, ", RD: %s, Originator %s", bgp_vpn_rd_print(ndo, pptr), diff --git a/print-lwres.c b/print-lwres.c index 1c195a4d6..664146af5 100644 --- a/print-lwres.c +++ b/print-lwres.c @@ -291,7 +291,9 @@ lwres_print(netdissect_options *ndo, if (ndo->ndo_vflag || v != LWRES_LWPACKETVERSION_0) ND_PRINT(" v%u", v); if (v != LWRES_LWPACKETVERSION_0) { - s = bp + GET_BE_U_4(np->length); + uint32_t pkt_len = GET_BE_U_4(np->length); + ND_TCHECK_LEN(bp, pkt_len); + s = bp + pkt_len; goto tail; } diff --git a/print-ospf6.c b/print-ospf6.c index 49167954e..b1325364d 100644 --- a/print-ospf6.c +++ b/print-ospf6.c @@ -388,14 +388,23 @@ static int ospf6_print_lshdr(netdissect_options *ndo, const struct lsa6_hdr *lshp, const u_char *dataend) { + u_int ls_length; + if ((const u_char *)(lshp + 1) > dataend) goto trunc; + ls_length = GET_BE_U_2(lshp->ls_length); + if (ls_length < sizeof(struct lsa_hdr)) { + ND_PRINT("\n\t Bogus length %u < header (%zu)", ls_length, + sizeof(struct lsa_hdr)); + goto trunc; + } + ND_PRINT("\n\t Advertising Router %s, seq 0x%08x, age %us, length %zu", GET_IPADDR_STRING(lshp->ls_router), GET_BE_U_4(lshp->ls_seq), GET_BE_U_2(lshp->ls_age), - GET_BE_U_2(lshp->ls_length)-sizeof(struct lsa6_hdr)); + ls_length-sizeof(struct lsa6_hdr)); ospf6_print_ls_type(ndo, GET_BE_U_2(lshp->ls_type), &lshp->ls_stateid); @@ -734,7 +743,7 @@ ospf6_decode_v3(netdissect_options *ndo, const struct lsr6 *lsrp; const struct lsa6_hdr *lshp; const struct lsa6 *lsap; - int i; + uint32_t i; switch (GET_U_1(op->ospf6_type)) { diff --git a/print-snmp.c b/print-snmp.c index 1fc08f380..42c9785ae 100644 --- a/print-snmp.c +++ b/print-snmp.c @@ -66,6 +66,7 @@ #include #include +#include #ifdef USE_LIBSMI #include @@ -531,7 +532,7 @@ asn1_parse(netdissect_options *ndo, break; case INTEGER: { - int32_t data; + uint32_t data; elem->type = BE_INT; data = 0; @@ -540,7 +541,7 @@ asn1_parse(netdissect_options *ndo, goto invalid; } if (GET_U_1(p) & ASN_BIT8) /* negative */ - data = -1; + data = UINT_MAX; for (i = elem->asnlen; i != 0; p++, i--) data = (data << ASN_SHIFT8) | GET_U_1(p); elem->data.integer = data; @@ -726,7 +727,8 @@ asn1_print(netdissect_options *ndo, break; case BE_OID: { - int o = 0, first = -1; + int first = -1; + uint32_t o = 0; p = (const u_char *)elem->data.raw; i = asnlen; diff --git a/tests/TESTLIST b/tests/TESTLIST index ecc733044..3e7034eb9 100644 --- a/tests/TESTLIST +++ b/tests/TESTLIST @@ -909,3 +909,11 @@ quic_handshake quic_handshake.pcap quic_handshake.out -v quic_handshake_truncated quic_handshake_truncated.pcap quic_handshake_truncated.out -v quic_retry quic_retry.pcap quic_retry.out -v gquic gquic.pcap gquic.out -v + +# Undefined behavior tests +bgp-ub bgp-ub.pcap bgp-ub.out -v +fletcher-checksum-negative-shift fletcher-checksum-negative-shift.pcap fletcher-checksum-negative-shift.out -v +ip-snmp-leftshift-unsigned ip-snmp-leftshift-unsigned.pcap ip-snmp-leftshift-unsigned.out +ip6-snmp-oid-unsigned ip6-snmp-oid-unsigned.pcap ip6-snmp-oid-unsigned.out +lwres-pointer-arithmetic-ub lwres-pointer-arithmetic-ub.pcap lwres-pointer-arithmetic-ub.out +ospf-signed-integer-ubsan ospf-signed-integer-ubsan.pcap ospf-signed-integer-ubsan.out -vv diff --git a/tests/bgp-ub.out b/tests/bgp-ub.out new file mode 100644 index 000000000..10cdede31 --- /dev/null +++ b/tests/bgp-ub.out @@ -0,0 +1,227 @@ + 1 13:29:37.678220 IP (tos 0x0, ttl 64, id 1, offset 0, flags [none], proto TCP (6), length 4748) + 127.0.0.1.540 > 127.0.0.1.179: Flags [S], cksum 0xf1a8 (correct), seq 0:4708, win 8192, length 4708: BGP [|bgp] + Update Message (2), length: 154 + Origin (1), length: 1, Flags [T]: Incomplete + AS Path (2), length: 0, Flags [T]: empty + Multi Exit Discriminator (4), length: 4, Flags [O]: 0 + Local Preference (5), length: 4, Flags [T]: 4456548 + Extended Community (16), length: 8, Flags [OT]: + target (0x0002), Flags [none]: 18826:630 (= 0.0.2.118) + Cluster List (10), length: 4, Flags [O]: 172.17.0.0 + Originator ID (9), length: 4, Flags [O]: 172.17.0.5 + Multi-Protocol Reach NLRI (14), length: 81, Flags [OE]: + AFI: IPv4 (1), SAFI: labeled VPN Unicast (128) + nexthop: RD: 0:0 (= 0.0.0.0), 172.145.0.5, nh-length: 12, no SNPA + RD: 18826:630 (= 0.0.2.118), 172.17.30.208/28, label:1027 (bottom) + RD: 18826:630 (= 0.0.2.118), 172.17.30.224/28, label:1027 (bottom) + (illegal prefix length) + Update Message (2), length: 105 + Origin (1), length: 1, Flags [T]: Incomplete + AS Path (2), length: 0, Flags [T]: empty + Multi Exit Discriminator (4), length: 4, Flags [O]: 0 + Local Preference (5), length: 4, Flags [T]: 100 + Extended Community (16), length: 8, Flags [OT]: + target (0x0002), Flags [none]: 18826:620 (= 0.0.2.108) + Cluster List (10), length: 37, Flags [O]: invalid len + Unknown Attribute (73), length: 138 [path attrs too short] + Update Message (2), length: 154 + Origin (1), length: 1, Flags [T]: Incomplete + AS Path (2), length: 0, Flags [T]: empty + Multi Exit Discriminator (4), length: 4, Flags [O]: 0 + Local Preference (5), length: 4, Flags [T]: 100 + Extended Community (16), length: 8, Flags [OT]: + target (0x0002), Flags [none]: 18826:640 (= 0.0.2.128) + Cluster List (10), length: 4, Flags [O]: 172.17.0.0 + Originator ID (9), length: 4, Flags [O]: 172.17.0.5 + Multi-Protocol Reach NLRI (14), length: 81, Flags [OE]: + AFI: IPv4 (1), SAFI: labeled VPN Unicast (128) + nexthop: RD: 0:0 (= 0.0.0.0), 172.17.0.5, nh-length: 12, no SNPA + RD: 18826:640 (= 0.0.2.128), 172.17.33.64/28, label:1028 (bottom) + RD: 18826:640 (= 0.0.2.128), 172.17.33.80/28, label:1028 (bottom) + RD: 18826:640 (= 0.0.2.128), 172.84.34.0/28, label:132100 (bottom) + RD: 18826:549 (= 0.0.2.37), 0.17.34.16/28, label:1028 (bottom) + Update Message (2), length: 202 + Withdrawn routes: + 0.0.0.0/0 + (illegal prefix length) [|bgp] [|bgp] + Update Message (2), length: 106 + Origin (1), length: 1, Flags [T]: Incomplete + AS Path (2), length: 0, Flags [T]: empty + Attribute Set (128), length: 3, Flags [O]: [|bgp] [|bgp] + Update Message (2), length: 172 + Origin (1), length: 1, Flags [T]: Incomplete + AS Path (2), length: 4, Flags [T]: 64520 + Multi Exit Discriminator (4), length: 4, Flags [O]: 131 + Unknown Attribute (113), length: 16, Flags [T]: + no Attribute 113 decoder + 0x0000: ffff ffff ffff ffff ffff ffff ffff ffff + Unknown Attribute (75), length: 2 + no Attribute 75 decoder + 0x0000: 0000 + Unknown Attribute (47), length: 64 + no Attribute 47 decoder + 0x0000: 0101 0040 0206 0201 0001 0000 4003 04c0 + 0x0010: 0002 02c0 2018 0001 0000 0000 0001 0000 + 0x0020: 0001 0001 0000 0000 0001 0000 0002 20cb + 0x0030: 0071 0cff ffff ffff ffff ffff ffff ffff + Reserved for development (255), length: 65280, Flags [OTPE+f]: [path attrs too short] [|bgp] + Update Message (2), length: 75 + Origin (1), length: 1, Flags [T]: IGP + AS Path (2), length: 6, Flags [T]: 65536 + Next Hop (3), length: 4, Flags [T]: 192.0.2.2 + Large Community (32), length: 24, Flags [OT]: + 65536:0:1, 65536:1:0 + Updated routes: + 203.0.113.15/32 + Update Message (2), length: 87 + Origin (1), length: 1, Flags [T]: IGP + AS Path (2), length: 6, Flags [T]: 65536 + Next Hop (3), length: 4, Flags [T]: 5.12.0.0 + Unknown Attribute (100), length: 192, Flags [+1]: [path attrs too short] + Updated routes: + 0.0.0.0/0 + (illegal prefix length) [|bgp] + Update Message (2), length: 105 + Origin (1), length: 1, Flags [T]: Incomplete + AS Path (2), length: 0, Flags [T]: empty + Multi Exit Discriminator (4), length: 4, Flags [O]: 0 + Local Preference (5), length: 4, Flags [T]: 100 + Extended Community (16), length: 8, Flags [OT]: + target (0x0002), Flags [none]: 18826:620 (= 0.0.2.108) + Cluster List (10), length: 37, Flags [O]: invalid len + Unknown Attribute (73), length: 138 [path attrs too short] + Update Message (2), length: 154 + Origin (1), length: 1, Flags [T]: Incomplete + AS Path (2), length: 0, Flags [T]: empty + Multi Exit Discriminator (4), length: 4, Flags [O]: 0 + Local Preference (5), length: 4, Flags [T]: 100 + Extended Community (16), length: 8, Flags [OT]: + target (0x0002), Flags [none]: 18826:640 (= 0.0.2.128) + Cluster List (10), length: 4, Flags [O]: 172.17.0.0 + Originator ID (9), length: 4, Flags [O]: 172.17.0.5 + Multi-Protocol Reach NLRI (14), length: 81, Flags [OE]: + AFI: IPv4 (1), SAFI: labeled VPN Unicast (128) + nexthop: RD: 0:0 (= 0.0.0.0), 172.17.0.5, nh-length: 12, no SNPA + RD: 18826:640 (= 0.0.2.128), 172.17.33.64/28, label:1028 (bottom) + RD: 18826:640 (= 0.0.2.128), 172.17.33.80/28, label:1028 (bottom) + RD: 18826:640 (= 0.0.2.128), 172.84.34.0/28, label:132100 (bottom) + RD: 18826:549 (= 0.0.2.37), 0.17.34.16/28, label:1028 (bottom) + Update Message (2), length: 202 + Withdrawn routes: + 0.0.0.0/0 + (illegal prefix length) [|bgp] [|bgp] + Update Message (2), length: 106 + Origin (1), length: 1, Flags [T]: Incomplete + AS Path (2), length: 0, Flags [T]: empty + Attribute Set (128), length: 3, Flags [O]: [|bgp] [|bgp] + Update Message (2), length: 172 + Origin (1), length: 1, Flags [T]: Incomplete + AS Path (2), length: 4, Flags [T]: 64520 + Multi Exit Discriminator (4), length: 4, Flags [O]: 131 + Unknown Attribute (113), length: 16, Flags [T]: + no Attribute 113 decoder + 0x0000: ffff ffff ffff ffff ffff ffff ffff ffff + Unknown Attribute (75), length: 2 + no Attribute 75 decoder + 0x0000: 0000 + Unknown Attribute (47), length: 64 + no Attribute 47 decoder + 0x0000: 0101 0040 0206 0201 0001 0000 4003 04c0 + 0x0010: 0002 02c0 2018 0001 0000 0000 0001 0000 + 0x0020: 0001 0001 0000 0000 0001 0000 0002 20cb + 0x0030: 0071 0cff ffff ffff ffff ffff ffff ffff + Reserved for development (255), length: 65280, Flags [OTPE+f]: [path attrs too short] [|bgp] + Update Message (2), length: 75 + Origin (1), length: 1, Flags [T]: IGP + AS Path (2), length: 6, Flags [T]: 65536 + Next Hop (3), length: 4, Flags [T]: 192.0.2.2 + Large Community (32), length: 24, Flags [OT]: + 65536:0:1, 65536:1:0 + Updated routes: + 203.0.113.15/32 + Update Message (2), length: 87 + Origin (1), length: 1, Flags [T]: IGP + AS Path (2), length: 6, Flags [T]: 65536 + Next Hop (3), length: 4, Flags [T]: 5.12.0.0 + Unknown Attribute (100), length: 192, Flags [+1]: [path attrs too short] + Updated routes: + 0.0.0.0/0 + (illegal prefix length) [|bgp] + Update Message (2), length: 106 + Origin (1), length: 1, Flags [T]: Incomplete + AS Path (2), length: 0, Flags [T]: empty + Multi Exit Discriminator (4), length: 4, Flags [O]: 0 + Local Preference (5), length: 4, Flags [T]: 100 + Extended Community (16), length: 8, Flags [OT]: + target (0x0002), Flags [none]: 18826:610 (= 0.0.2.98) + Cluster List (10), length: 40, Flags [O]: 24.120.4.0, 0.0.0.41, 24.120.4.1, 64.15.19.0, 1.1.0.0, 2.188.24.32, 45.0.0.0, 2.189.24.32, 45.1.64.14, 61.0.2.1 + Large Community (32), length: 0, Flags [E]: invalid len + Unknown Attribute (21), length: 24 [path attrs too short] [|bgp] + Update Message (2), length: 100 + Unknown Attribute (0), length: 0 + no Attribute 0 decoder + Reserved for development (255), length: 255 [path attrs too short] [|bgp] + Update Message (2), length: 95 + Origin (1), length: 1, Flags [T]: IGP + AS Path (2), length: 0, Flags [T]: empty + Local Preference (5), length: 4, Flags [T]: 100 + Extended Community (16), length: 8, Flags [OT]: + target (0x0002), Flags [none]: 1:1 (= 0.0.0.1) + PMSI Tunnel (22), length: 17, Flags [OT]: + Tunnel-type RSVP-TE P2MP LSP (1), Flags [none], MPLS Label 0 + Extended-Tunnel-ID 10.0.0.4, P2MP-ID 0x00008173 + Multi-Protocol Reach NLRI (14), length: 23, Flags [OE]: + AFI: IPv4 (1), SAFI: Multicast VPN (5) + nexthop: 10.0.0.4, nh-length: 4 + 8 SNPA + 1 bytes + 0 bytes + 0 bytes + 0 bytes + 1 bytes + 0 bytes + 1 bytes + 0 bytes + Route-Type: Unknown (181), length: 0 [|bgp] [|bgp] + Update Message (2), length: 106 + Origin (1), length: 1, Flags [T]: Incomplete + AS Path (2), length: 0, Flags [T]: empty + Multi Exit Discriminator (4), length: 4, Flags [O]: 0 + Local Preference (5), length: 4, Flags [T]: 100 + Extended Community (16), length: 8, Flags [OT]: + target (0x0002), Flags [none]: 18826:610 (= 0.0.2.98) + Cluster List (10), length: 40, Flags [O]: 24.120.4.0, 0.0.0.41, 24.120.4.1, 64.15.19.0, 1.1.0.0, 2.188.24.32, 45.0.0.0, 2.189.24.32, 45.1.64.14, 61.0.2.1 + Large Community (32), length: 0, Flags [E]: invalid len + Unknown Attribute (21), length: 24 [path attrs too short] [|bgp] + Update Message (2), length: 100 + Unknown Attribute (0), length: 0 + no Attribute 0 decoder + Reserved for development (255), length: 255 [path attrs too short] [|bgp] + Update Message (2), length: 95 + Origin (1), length: 1, Flags [T]: IGP + AS Path (2), length: 0, Flags [T]: empty + Local Preference (5), length: 4, Flags [T]: 100 + Extended Community (16), length: 8, Flags [OT]: + target (0x0002), Flags [none]: 1:1 (= 0.0.0.1) + PMSI Tunnel (22), length: 17, Flags [OT]: + Tunnel-type RSVP-TE P2MP LSP (1), Flags [none], MPLS Label 0 + Extended-Tunnel-ID 10.0.0.4, P2MP-ID 0x00008173 + Multi-Protocol Reach NLRI (14), length: 23, Flags [OE]: + AFI: IPv4 (1), SAFI: Multicast VPN (5) + nexthop: 10.0.0.4, nh-length: 4 + 8 SNPA + 1 bytes + 0 bytes + 0 bytes + 0 bytes + 1 bytes + 0 bytes + 0 bytes + 1 bytes + Route-Type: Unknown (0), length: 0 + Route-Type: Intra-AS Segment-Leaf (4), length: 255 + Update Message (2), length: 30 + Multi-Protocol Unreach NLRI (15), length: 3, Flags [OE]: + AFI: IPv4 (1), SAFI: labeled VPN Unicast (128) + End-of-Rib Marker (empty NLRI) +[|BGP Unknown Message Type] diff --git a/tests/bgp-ub.pcap b/tests/bgp-ub.pcap new file mode 100644 index 000000000..3724aee70 Binary files /dev/null and b/tests/bgp-ub.pcap differ diff --git a/tests/fletcher-checksum-negative-shift.out b/tests/fletcher-checksum-negative-shift.out new file mode 100644 index 000000000..bed9815ab --- /dev/null +++ b/tests/fletcher-checksum-negative-shift.out @@ -0,0 +1,41 @@ + 1 13:44:56.520846 IS-IS, length 495 + L2 LSP, hlen: 27, v: 1, pdu-v: 1, sys-id-len: 6 (0), max-area: 3 (0) + lsp-id: 0192.0168.0001.00-00, seq: 0x0000000b, lifetime: 1196s + chksum: 0xc074 (incorrect should be 0xdc23), PDU length: 495, Flags: [ L2 IS ] + Area address(es) TLV #1, length: 4 + Area address (length: 3): 49.0002 + LSP Buffersize TLV #14, length: 2 + LSP Buffersize: 1426 + Area address(es) TLV #1, length: 104 + Area address (length: 0): isonsap_string: illegal length + Area address (length: 1): 00 + Area address (length: 0): isonsap_string: illegal length + Area address (length: 0): isonsap_string: illegal length + Area address (length: 0): isonsap_string: illegal length + Area address (length: 0): isonsap_string: illegal length + Area address (length: 11): c0.7403.0104.0349.0002.0e02 + Area address (length: 5): d4.8102.cc8e + Partition DIS TLV #4, length: 8 + 0000.0180.0000 + unknown TLV #11, length: 32 + 0x0000: 4cee 6b28 4cee 6b28 4cee 6b28 4cee 6b28 + 0x0010: 4cee 6b28 4cee 6b28 4cee 6b28 4cee 6b28 + Authentication TLV #10, length: 4 + unknown Authentication type 0x4c: + 0x0000: ee6b 28 + LSP entries TLV #9, length: 4 + ES Neighbor(s) TLV #3, length: 4 + unknown TLV #32, length: 11 + 0x0000: 3000 0192 0168 0002 0000 12 + Area address(es) TLV #1, length: 146 + Area address (length: 1): 68 + Area address (length: 0): isonsap_string: illegal length + Area address (length: 3): 02.0000 + Area address (length: 63): isonsap_string: illegal length + Area address (length: 3): 04.0000 + Area address (length: 0): isonsap_string: illegal length + Area address (length: 0): isonsap_string: illegal length + Area address (length: 32): isonsap_string: illegal length + Area address (length: 8): 00.0001.8300.0000.00 + Area address (length: 11): 20.4cee.6b28.4cee.6b28.4cee + unknown TLV #76, length: 238 [|isis] diff --git a/tests/fletcher-checksum-negative-shift.pcap b/tests/fletcher-checksum-negative-shift.pcap new file mode 100644 index 000000000..63c39f3ef Binary files /dev/null and b/tests/fletcher-checksum-negative-shift.pcap differ diff --git a/tests/ip-snmp-leftshift-unsigned.out b/tests/ip-snmp-leftshift-unsigned.out new file mode 100644 index 000000000..eaf0779b2 --- /dev/null +++ b/tests/ip-snmp-leftshift-unsigned.out @@ -0,0 +1 @@ + 1 14:35:45.695106 IP truncated-ip - 34734 bytes missing! 10.0.0.0.162 > 154.1.214.234.65535: [!init SEQ]-1 diff --git a/tests/ip-snmp-leftshift-unsigned.pcap b/tests/ip-snmp-leftshift-unsigned.pcap new file mode 100644 index 000000000..de897628d Binary files /dev/null and b/tests/ip-snmp-leftshift-unsigned.pcap differ diff --git a/tests/ip6-snmp-oid-unsigned.out b/tests/ip6-snmp-oid-unsigned.out new file mode 100644 index 000000000..98aa60111 --- /dev/null +++ b/tests/ip6-snmp-oid-unsigned.out @@ -0,0 +1 @@ + 1 12:36:48.416500 IP6 fe80::20c:29ff:fe9b:a15d.161 > fe80::20c:0:0:0.546: [!init SEQ].1.11.1.99.0.0.0.0.0.0.4.4.71.8327.1936855.0.1.0.14.0.1.0.1.24.14347.63.0.12.41.57.14824.0.2.0.14.0.1.0.1.24.1821339.0.12.41.446675.0.56.0.61.0.11.0.16.42.1.0.0.4294967168.0.0.0.0.0.0.0.0.0.0.1.0.2.3.110.116.112.7.101.120.97 diff --git a/tests/ip6-snmp-oid-unsigned.pcap b/tests/ip6-snmp-oid-unsigned.pcap new file mode 100644 index 000000000..aeed21350 Binary files /dev/null and b/tests/ip6-snmp-oid-unsigned.pcap differ diff --git a/tests/lwres-pointer-arithmetic-ub.out b/tests/lwres-pointer-arithmetic-ub.out new file mode 100644 index 000000000..f4953f4b6 --- /dev/null +++ b/tests/lwres-pointer-arithmetic-ub.out @@ -0,0 +1 @@ + 1 14:31:29.364332 IP6 fe80:0:10ff:15:1800:1a00:0:100.921 > a00:300:115:1800:1a00:f4:100:a00.0: lwres v41634 [|lwres] diff --git a/tests/lwres-pointer-arithmetic-ub.pcap b/tests/lwres-pointer-arithmetic-ub.pcap new file mode 100644 index 000000000..095fcbcba Binary files /dev/null and b/tests/lwres-pointer-arithmetic-ub.pcap differ diff --git a/tests/ospf-signed-integer-ubsan.out b/tests/ospf-signed-integer-ubsan.out new file mode 100644 index 000000000..b5b0472a1 --- /dev/null +++ b/tests/ospf-signed-integer-ubsan.out @@ -0,0 +1,3 @@ + 1 15:39:26.444985 IP6 (class 0xe0, hlim 1, next-header AH (51) payload length: 532) fe80::1 > fe80::2: AH(length=4(24-bytes),spi=0x00000100,seq=0x1e,icv=0x0a6ab0b271917e05f7a01c58): OSPFv3, LS-Update, length 508 + Router-ID 1.1.1.108, Area 11.234.210.1, Instance 1 + Bogus length 0 < header (20) [|ospf3] diff --git a/tests/ospf-signed-integer-ubsan.pcap b/tests/ospf-signed-integer-ubsan.pcap new file mode 100644 index 000000000..11446d9c4 Binary files /dev/null and b/tests/ospf-signed-integer-ubsan.pcap differ