BPF: Address review comments

Author: rsmarples

src/bpf-bsd.c

@@ -138,7 +138,7 @@ bpf_read(struct bpf *bpf, void *data, size_t len)
 {
 	ssize_t bytes;
 	struct bpf_hdr packet;
-	const char *payload;
+	const uint8_t *payload;
 
 	bpf->bpf_flags &= ~BPF_EOF;
 	for (;;) {
@@ -159,11 +159,21 @@ bpf_read(struct bpf *bpf, void *data, size_t len)
 			bpf->bpf_pos = 0;
 		}
 		bytes = -1;
-		payload = (const char *)bpf->bpf_buffer + bpf->bpf_pos;
+		if (bpf->bpf_pos + sizeof(packet) > bpf->bpf_len) {
+			errno = EINVAL;
+			goto err;
+		}
+		payload = (const uint8_t *)bpf->bpf_buffer + bpf->bpf_pos;
 		memcpy(&packet, payload, sizeof(packet));
-		if (bpf->bpf_pos + packet.bh_caplen + packet.bh_hdrlen >
-		    bpf->bpf_len)
-			goto next; /* Packet beyond buffer, drop. */
+		if (packet.bh_hdrlen > SIZE_MAX - packet.bh_caplen) {
+			errno = EOVERFLOW;
+			goto err;
+		}
+		if (packet.bh_hdrlen + packet.bh_caplen >
+		    bpf->bpf_len - bpf->bpf_pos) {
+			errno = EBADMSG;
+			goto err;
+		}
 		payload += packet.bh_hdrlen;
 		if (packet.bh_caplen > len)
 			bytes = (ssize_t)len;
@@ -174,7 +184,6 @@ bpf_read(struct bpf *bpf, void *data, size_t len)
 		else
 			bpf->bpf_flags &= ~BPF_BCAST;
 		memcpy(data, payload, (size_t)bytes);
-	next:
 		bpf->bpf_pos += BPF_WORDALIGN(
 		    packet.bh_hdrlen + packet.bh_caplen);
 		if (bpf->bpf_pos >= bpf->bpf_len) {
@@ -186,6 +195,11 @@ bpf_read(struct bpf *bpf, void *data, size_t len)
 	}
 
 	/* NOTREACHED */
+
+err:
+	bpf->bpf_len = bpf->bpf_pos = 0;
+	bpf->bpf_flags |= BPF_EOF;
+	return -1;
 }
 
 int

src/bpf-linux.c

@@ -64,6 +64,7 @@ bpf_open(const struct interface *ifp,
 		return NULL;
 	bpf->bpf_ifp = ifp;
 	bpf->bpf_flags = BPF_EOF;
+	bpf->bpf_fd = -1;
 
 	/* Allocate a suitably large buffer for a single packet. */
 	bpf->bpf_size = ETH_FRAME_LEN;

src/bpf-pcap.c

@@ -124,6 +124,8 @@ bpf_read(struct bpf *bpf, void *data, size_t len)
 
 	err = pcap_next_ex(bpf->bpf_handle, &pkt_header, &pkt_data);
 
+	if (err == 0)
+		return 0;
 	if (err < 0)
 		return -1;
 

src/bpf.c

@@ -365,7 +365,6 @@ bpf_arp_rw(const struct bpf *bpf, const struct in_addr *ia, bool recv)
 	len = (unsigned int)(bp - buf);
 	if (recv) return bpf_setfilter(bpf, buf, len);
 	return bpf_setwfilter(bpf, buf, len);
-		return -1;
 }
 
 int