yarrp
yarrp copied to clipboard
Potential Buffer Handling Issue in yarrp's Response Packet Processing
Hello yarrp maintainers,
We have identified a potential issue in yarrp's listener.cpp
and listener6.cpp
regarding how response packets are handled. Specifically, the buffer (buf
) is not cleared after processing a response packet. This can lead to scenarios where, if a response packet is shorter than the one before it, the remaining part of the buffer will retain portions of the previous packet's content. Additionally, there is no check or handling based on packet length in icmp.cpp
and icmp6.cpp
, which could lead to further complications.
This issue could potentially result in:
- Response packets that are not from yarrp probes being incorrectly identified as responses to yarrp probes.
- Incorrect handling of responses from routers that do not include the payload or only include part of it, leading to parsing errors.
We suggest clearing the buffer (buf
) after each response packet is processed and implementing packet length checks and handling in icmp.cpp
and icmp6.cpp
to address these concerns.
Thank you for looking into this matter.