Check the instance of ADDR_ENTRY[0]

secdev · Oct 19, 2024 · 48a3f2f · 48a3f2f
1 parent 6f0faf3
commit 48a3f2f
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 1 deletion.
diff --git a/scapy/layers/netbios.py b/scapy/layers/netbios.py
@@ -185,7 +185,8 @@ class NBNSQueryResponse(Packet):
                    ]
 
     def mysummary(self):
-        if not self.ADDR_ENTRY:
+        if not self.ADDR_ENTRY or \
+           not isinstance(self.ADDR_ENTRY[0], NBNS_ADD_ENTRY):
             return "NBNSQueryResponse"
         return "NBNSQueryResponse '\\\\%s' is at %s" % (
             self.RR_NAME.decode(errors="backslashreplace"),

diff --git a/test/scapy/layers/netbios.uts b/test/scapy/layers/netbios.uts
@@ -99,3 +99,12 @@ assert pkt[NBNSWackResponse].RR_NAME == b'SARAH'
 z = raw(TCP()/NBTSession())
 assert z == b'\x00\x8b\x00\x8b\x00\x00\x00\x00\x00\x00\x00\x00P\x02 \x00\x00\x00\x00\x00\x00\x00\x00\x00'
 assert NBTSession in TCP(z)
+
+= OSS-Fuzz Findings
+
+# Note: the packet is corrupted
+conf.debug_dissector = False
+raw_packet = b'E\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x05\x00\x00\x00'
+packet = NBNSQueryResponse(raw_packet)
+assert packet.summary() == "NBNSQueryResponse"
+conf.debug_dissector = True