[monitoring-plugins] check_icmp: Reject negative ICMP data length

[Holger Weiss]

 Module: monitoring-plugins
 Branch: master
 Commit: f732906649f8b6a5ee5636ece10d19e4519b790b
 Author: Holger Weiss <holger at zedat.fu-berlin.de>
   Date: Tue Jun 30 16:20:12 2026 +0200
    URL: https://www.monitoring-plugins.org/repositories/monitoring-plugins/commit/?id=f7329066

check_icmp: Reject negative ICMP data length

The -b/--size handler checks the lower bound after casting the value to
unsigned long while checking the upper bound as a signed comparison.  A
negative argument such as "-b -65536" therefore satisfies both checks.
The value is then truncated to an undersized icmp_data_size, which later
serves as the size of the ICMP send buffer, so building the packet
overflows that buffer.

Compare the size as a signed long against both bounds so negative values
are rejected.

Reported-by: Christopher Kreft <Email at ChristopherKreft.de>

---

 plugins-root/check_icmp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins-root/check_icmp.c b/plugins-root/check_icmp.c
index 8f5c1fe4..14e63c89 100644
--- a/plugins-root/check_icmp.c
+++ b/plugins-root/check_icmp.c
@@ -411,7 +411,7 @@ check_icmp_config_wrapper process_arguments(int argc, char **argv) {
 			switch (arg) {
 			case 'b': {
 				long size = strtol(optarg, NULL, 0);
-				if ((unsigned long)size >= (sizeof(struct icmp) + sizeof(struct icmp_ping_data)) &&
+				if (size >= (long)(sizeof(struct icmp) + sizeof(struct icmp_ping_data)) &&
 					size < MAX_PING_DATA) {
 					result.config.icmp_data_size = (unsigned short)size;
 				} else {