From f5bff09ffe842f623c20a6bffee162adc2e8a1ef Mon Sep 17 00:00:00 2001 From: rnhmjoj Date: Sat, 17 Jun 2023 20:41:54 +0200 Subject: [PATCH] Fix undefined behavior Returning a pointer to a static buffer in an object that is later deleted results in an empty IP header, depending on the compiler and optimisation level. Instead we can write directly inside the packet buffer. --- src/FakeroutePacket.cpp | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/src/FakeroutePacket.cpp b/src/FakeroutePacket.cpp index dfac219..33d09f6 100644 --- a/src/FakeroutePacket.cpp +++ b/src/FakeroutePacket.cpp @@ -110,17 +110,16 @@ void FakeroutePacket::buildIcmpHeader(char* packet, int protocol) { struct iphdr *fakeIpHdr; struct icmp *icmpHeader = (struct icmp*)packet; - char fakePacket[IP_HDR_SIZE] = {0}; - fakeIpHdr = (struct iphdr*)fakePacket; + icmpHeader->icmp_type = getIcmpType(); + icmpHeader->icmp_code = getIcmpCode(); + + fakeIpHdr = (struct iphdr*) &icmpHeader->icmp_ip; fakeIpHdr->ihl = 5; fakeIpHdr->version = 4; fakeIpHdr->protocol = protocol; fakeIpHdr->saddr = inet_addr(receivedSourceAddress); fakeIpHdr->daddr = inet_addr(spoofedDestinationAddress); - icmpHeader->icmp_type = getIcmpType(); - icmpHeader->icmp_code = getIcmpCode(); - icmpHeader->icmp_ip = *(struct ip*)fakePacket; icmpHeader->icmp_cksum = (unsigned short)in_cksum((unsigned short*)packet, ICMP_HDR_SIZE + 8); }