Merge commit from fork

Fix multiple NextX Duo vulnerabilities.

4 files changed, 54 insertions, 1 deletions

diff --git a/common/src/nx_icmpv6_validate_options.c b/common/src/nx_icmpv6_validate_options.c
index b17b0c19..46063488 100644
--- a/common/src/nx_icmpv6_validate_options.c
+++ b/common/src/nx_icmpv6_validate_options.c
@@ -81,7 +81,10 @@ UINT _nx_icmpv6_validate_options(NX_ICMPV6_OPTION *option, INT length, INT addit
 UINT option_len;
 
     /* Parse all option headers from the ICMPv6 header. */
-    while (length > 0)
+    /* GHSA-rf32-h832-hg8r:
+       Verify that the length is at least 2 to cover nx_icmpv6_option_length and 
+       nx_icmpv6_option_type. */
+    while (length > 2)
     {
         /* Verify that the option length is not zero. */
         if (option -> nx_icmpv6_option_length == 0)
diff --git a/common/src/nx_ip_packet_receive.c b/common/src/nx_ip_packet_receive.c
index fbafdd6a..153e903d 100644
--- a/common/src/nx_ip_packet_receive.c
+++ b/common/src/nx_ip_packet_receive.c
@@ -101,6 +101,19 @@ UCHAR version_byte;
         packet_ptr -> nx_packet_address.nx_packet_interface_ptr = &(ip_ptr -> nx_ip_interface[0]);
     }
 
+    /* GHSA-pf5q-r6q5-6j2f:  
+       This is an IPv4 packet. Therefore the header length must be at least 20 bytes.
+       Validate the payload size before accessing the IP header. */
+    if(packet_ptr -> nx_packet_length < sizeof(NX_IPV4_HEADER))
+    {
+        /* Invalid payload length */
+
+        /* Drop the packet. */
+        _nx_packet_release(packet_ptr);
+
+        return;        
+    }
+
     /* It's assumed that the IP link driver has positioned the top pointer in the
        packet to the start of the IP address... so that's where we will start.  */
     version_byte =  *(packet_ptr -> nx_packet_prepend_ptr);
diff --git a/common/src/nx_ipv4_option_process.c b/common/src/nx_ipv4_option_process.c
index 758d8516..45f91fc2 100644
--- a/common/src/nx_ipv4_option_process.c
+++ b/common/src/nx_ipv4_option_process.c
@@ -143,6 +143,19 @@ UINT            op_timestamp_counter = 0;
                 return(NX_FALSE);
             }
 
+            /* GHSA-vwh7-h99r-fvwq:
+               Validate that there are at least 3 bytes in the packet, which allows the option_process logic to read type/length/offset. */
+            if((ip_option_length - index) < 3)
+            {
+#ifndef NX_DISABLE_ICMPV4_ERROR_MESSAGE
+                /* Option length error, send a Parameter Problem Message .  */
+                /*lint -e{835} -e{845} suppress operating on zero. */
+                NX_ICMPV4_SEND_PARAMETER_PROBLEM(ip_ptr, packet_ptr, NX_ICMP_ZERO_CODE, (ip_normal_length + index));
+#endif
+                /* Return NX_FALSE.  */
+                return(NX_FALSE);
+            }
+
             /* Get the option length.  */
             op_length = *(option_ptr + 1);
 
diff --git a/common/src/nx_ipv4_packet_receive.c b/common/src/nx_ipv4_packet_receive.c
index 5abbbfcd..70391436 100644
--- a/common/src/nx_ipv4_packet_receive.c
+++ b/common/src/nx_ipv4_packet_receive.c
@@ -116,6 +116,19 @@ UINT            packet_consumed;
     compute_checksum = 0;
 #endif /* NX_DISABLE_IP_RX_CHECKSUM */
 
+    /* GHSA-cf2g-j6vv-m8c5 
+       Validate that the payload length is at least the size of the IPv4 header. */
+    if(packet_ptr -> nx_packet_length < sizeof(NX_IPV4_HEADER))
+    {
+        /* Invalid payload length */
+
+        /* Drop the packet. */
+        _nx_packet_release(packet_ptr);
+
+        return;        
+    }
+    
+
     /* It's assumed that the IP link driver has positioned the top pointer in the
        packet to the start of the IP address... so that's where we will start.  */
     /*lint -e{927} -e{826} suppress cast of pointer to pointer, since it is necessary  */
@@ -686,6 +699,17 @@ UINT            packet_consumed;
             /* Adjust the length.  */
             packet_ptr -> nx_packet_length =  packet_ptr -> nx_packet_length - (ULONG)sizeof(NX_IPV4_HEADER);
 
+            /* GHSA-c9pq-93jp-w649:
+               Validate that the packet contains at least the UDP header. */
+            if(packet_ptr -> nx_packet_length < sizeof(NX_UDP_HEADER))
+            {
+                /* Invalid UDP packet. Release it and return. */
+                _nx_packet_release(packet_ptr);
+                
+                /* Return to caller.  */
+                return;
+            }
+
 #ifndef NX_DISABLE_IP_INFO
 
             /* Increment the number of packets delivered.  */