/*
 * netsniff-ng - the packet sniffing beast
 * Copyright 2009, 2010 Daniel Borkmann.
 * Subject to the GPL, version 2.
 */

#include <stdio.h>
#include <stdint.h>
#include <endian.h>
#include <netinet/in.h>    /* for ntohs() */
#include <asm/byteorder.h>

#include "proto.h"
#include "protos.h"
#include "lookup.h"
#include "built_in.h"
#include "pkt_buff.h"

struct tcphdr {
	uint16_t source;
	uint16_t dest;
	uint32_t seq;
	uint32_t ack_seq;
#if defined(__LITTLE_ENDIAN_BITFIELD)
	__extension__ uint16_t res1:4,
			       doff:4,
			       fin:1,
			       syn:1,
			       rst:1,
			       psh:1,
			       ack:1,
			       urg:1,
			       ece:1,
			       cwr:1;
#elif defined(__BIG_ENDIAN_BITFIELD)
	__extension__ uint16_t doff:4,
			       res1:4,
			       cwr:1,
			       ece:1,
			       urg:1,
			       ack:1,
			       psh:1,
			       rst:1,
			       syn:1,
			       fin:1;
#else
# error  "Adjust your <asm/byteorder.h> defines"
#endif
	uint16_t window;
	uint16_t check;
	uint16_t urg_ptr;
} __packed;

static void tcp(struct pkt_buff *pkt)
{
	struct tcphdr *tcp = (struct tcphdr *) pkt_pull(pkt, sizeof(*tcp));
	uint16_t src, dest;
	char *src_name, *dest_name;

	if (tcp == NULL)
		return;

	src = ntohs(tcp->source);
	dest = ntohs(tcp->dest);

	src_name = lookup_port_tcp(src);
	dest_name = lookup_port_tcp(dest);

	tprintf(" [ TCP ");
	tprintf("Port (%u", src);
	if (src_name)
		tprintf(" (%s%s%s)", colorize_start(bold), src_name,
			colorize_end());
	tprintf(" => %u", dest);
	if (dest_name)
		tprintf(" (%s%s%s)", colorize_start(bold), dest_name,
			colorize_end());
	tprintf("), ");
	tprintf("SN (0x%x), ", ntohl(tcp->seq));
	tprintf("AN (0x%x), ", ntohl(tcp->ack_seq));
	tprintf("DataOff (%u), ", tcp->doff);
	tprintf("Res (%u), ", tcp->res1);
	tprintf("Flags (");
	if (tcp->fin)
		tprintf("FIN ");
	if (tcp->syn)
		tprintf("SYN ");
	if (tcp->rst)
		tprintf("RST ");
	if (tcp->psh)
		tprintf("PSH ");
	if (tcp->ack)
		tprintf("ACK ");
	if (tcp->urg)
		tprintf("URG ");
	if (tcp->ece)
		tprintf("ECE ");
	if (tcp->cwr)
		tprintf("CWR ");
	tprintf("), ");
	tprintf("Window (%u), ", ntohs(tcp->window));
	tprintf("CSum (0x%.4x), ", ntohs(tcp->check));
	tprintf("UrgPtr (%u)", ntohs(tcp->urg_ptr));
	tprintf(" ]\n");
}

static void tcp_less(struct pkt_buff *pkt)
{
	struct tcphdr *tcp = (struct tcphdr *) pkt_pull(pkt, sizeof(*tcp));
	uint16_t src, dest;
	char *src_name, *dest_name;

	if (tcp == NULL)
		return;

	src = ntohs(tcp->source);
	dest = ntohs(tcp->dest);

	src_name = lookup_port_tcp(src);
	dest_name = lookup_port_tcp(dest);

	tprintf(" TCP %u", src);
	if(src_name)
		tprintf("(%s%s%s)", colorize_start(bold), src_name,
			colorize_end());
	tprintf("/%u", dest);
	if(dest_name)
		tprintf("(%s%s%s)", colorize_start(bold), dest_name,
			colorize_end());
	tprintf(" F%s",colorize_start(bold));
	if (tcp->fin)
		tprintf(" FIN");
	if (tcp->syn)
		tprintf(" SYN");
	if (tcp->rst)
		tprintf(" RST");
	if (tcp->psh)
		tprintf(" PSH");
	if (tcp->ack)
		tprintf(" ACK");
	if (tcp->urg)
		tprintf(" URG");
	if (tcp->ece)
		tprintf(" ECE");
	if (tcp->cwr)
		tprintf(" CWR");
	tprintf("%s Win %u S/A 0x%x/0x%x", colorize_end(),
		ntohs(tcp->window), ntohl(tcp->seq), ntohl(tcp->ack_seq));
}

struct protocol tcp_ops = {
	.key = 0x06,
	.print_full = tcp,
	.print_less = tcp_less,
};
e82b6bd3ddbb26b70acfa8947'>usb</a>/<a href='/cgit.cgi/linux/net-next.git/commit/drivers/usb/gadget?h=nds-private-remove&amp;id=83e526f2a2fa4b2e82b6bd3ddbb26b70acfa8947'>gadget</a>/<a href='/cgit.cgi/linux/net-next.git/commit/drivers/usb/gadget/Kconfig?h=nds-private-remove&amp;id=83e526f2a2fa4b2e82b6bd3ddbb26b70acfa8947'>Kconfig</a></div><div class='content'><div class='cgit-panel'><b>diff options</b><form method='get'><input type='hidden' name='h' value='nds-private-remove'/><input type='hidden' name='id' value='83e526f2a2fa4b2e82b6bd3ddbb26b70acfa8947'/><table><tr><td colspan='2'/></tr><tr><td class='label'>context:</td><td class='ctrl'><select name='context' onchange='this.form.submit();'><option value='1'>1</option><option value='2'>2</option><option value='3' selected='selected'>3</option><option value='4'>4</option><option value='5'>5</option><option value='6'>6</option><option value='7'>7</option><option value='8'>8</option><option value='9'>9</option><option value='10'>10</option><option value='15'>15</option><option value='20'>20</option><option value='25'>25</option><option value='30'>30</option><option value='35'>35</option><option value='40'>40</option></select></td></tr><tr><td class='label'>space:</td><td class='ctrl'><select name='ignorews' onchange='this.form.submit();'><option value='0' selected='selected'>include</option><option value='1'>ignore</option></select></td></tr><tr><td class='label'>mode:</td><td class='ctrl'><select name='dt' onchange='this.form.submit();'><option value='0' selected='selected'>unified</option><option value='1'>ssdiff</option><option value='2'>stat only</option></select></td></tr><tr><td/><td class='ctrl'><noscript><input type='submit' value='reload'/></noscript></td></tr></table></form></div><table summary='commit info' class='commit-info'>
<tr><th>author</th><td>Vincent Pelletier &lt;plr.vincent@gmail.com&gt;</td><td class='right'>2017-01-18 00:57:44 +0000</td></tr>
<tr><th>committer</th><td>Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;</td><td class='right'>2017-01-25 12:03:52 +0100</td></tr>
<tr><th>commit</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/drivers/usb/gadget/Kconfig?h=nds-private-remove&amp;id=83e526f2a2fa4b2e82b6bd3ddbb26b70acfa8947'>83e526f2a2fa4b2e82b6bd3ddbb26b70acfa8947</a> (<a href='/cgit.cgi/linux/net-next.git/patch/drivers/usb/gadget/Kconfig?id=83e526f2a2fa4b2e82b6bd3ddbb26b70acfa8947'>patch</a>)</td></tr>
<tr><th>tree</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/tree/?h=nds-private-remove&amp;id=83e526f2a2fa4b2e82b6bd3ddbb26b70acfa8947'>3067a6dfefc8299039bc89f9eca8dc36a77e1ab4</a> /<a href='/cgit.cgi/linux/net-next.git/tree/drivers/usb/gadget/Kconfig?h=nds-private-remove&amp;id=83e526f2a2fa4b2e82b6bd3ddbb26b70acfa8947'>drivers/usb/gadget/Kconfig</a></td></tr>
<tr><th>parent</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/drivers/usb/gadget/Kconfig?h=nds-private-remove&amp;id=d9b2997e4a0a874e452df7cdd7de5a54502bd0aa'>d9b2997e4a0a874e452df7cdd7de5a54502bd0aa</a> (<a href='/cgit.cgi/linux/net-next.git/diff/drivers/usb/gadget/Kconfig?h=nds-private-remove&amp;id=83e526f2a2fa4b2e82b6bd3ddbb26b70acfa8947&amp;id2=d9b2997e4a0a874e452df7cdd7de5a54502bd0aa'>diff</a>)</td></tr></table>
<div class='commit-subject'>usb: gadget: f_fs: Assorted buffer overflow checks.</div><div class='commit-msg'>OS descriptor head, when flagged as provided, is accessed without
checking if it fits in provided buffer. Verify length before access.
Also, there are other places where buffer length it checked
after accessing offsets which are potentially past the end. Check
buffer length before as well to fail cleanly.

Signed-off-by: Vincent Pelletier &lt;plr.vincent@gmail.com&gt;
Acked-by: Felipe Balbi &lt;felipe.balbi@linux.intel.com&gt;
Cc: stable &lt;stable@vger.kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</div><div class='diffstat-header'><a href='/cgit.cgi/linux/net-next.git/diff/?h=nds-private-remove&amp;id=83e526f2a2fa4b2e82b6bd3ddbb26b70acfa8947'>Diffstat</a> (limited to 'drivers/usb/gadget/Kconfig')</div><table summary='diffstat' class='diffstat'>