[patch] memcpy-overlap.patch

memcpy-overlap.patch (text/plain), 1.59 KB, created by Sergei Trofimovich (RETIRED) on 2013-10-05 08:40:21 UTC

Overlapping error was found by valgrind:

==24305== Command: ./airdecap-ng -e linksys -p dictionary ../test/wpa-psk-linksys.cap
==24305== 
==24305== Source and destination overlap in memcpy(0x60b938, 0x60b940, 139)
==24305==    at 0x4C2DCD3: memcpy@@GLIBC_2.14 (mc_replace_strmem.c:882)
==24305==    by 0x403265: main (airdecap-ng.c:877)
==24305== 
==24305== Source and destination overlap in memcpy(0x60b92c, 0x60b93e, 133)
==24305==    at 0x4C2DCD3: memcpy@@GLIBC_2.14 (mc_replace_strmem.c:882)
==24305==    by 0x4017CD: write_packet (airdecap-ng.c:165)
==24305==    by 0x4032A9: main (airdecap-ng.c:883)
==24305==

And was exhibited as corrupted packets in bug:

Gentoo-bug: https://bugs.gentoo.org/486984
diff --git a/src/airdecap-ng.c b/src/airdecap-ng.c
index 9a7090b..a71a6be 100644
--- a/src/airdecap-ng.c
+++ b/src/airdecap-ng.c
@@ -162,7 +162,8 @@ int write_packet( FILE *f_out, struct pcap_pkthdr *pkh, uchar *h80211 )
             pkh->len    -= 24 + qosh_offset + 6;
             pkh->caplen -= 24 + qosh_offset + 6;
 
-            memcpy( buffer + 12, h80211 + qosh_offset + 30, pkh->caplen );
+            /* can overlap */
+            memmove( buffer + 12, h80211 + qosh_offset + 30, pkh->caplen );
         }
         else
         {
@@ -874,7 +875,8 @@ usage:
                 /* WPA data packet was successfully decrypted, *
                  * remove the WPA Ext.IV & MIC, write the data */
 
-                memcpy( h80211 + z, h80211 + z + 8, pkh.caplen - z );
+                /* can overlap */
+                memmove( h80211 + z, h80211 + z + 8, pkh.caplen - z );
 
                 stats.nb_unwpa++;