check_icmp: Reject negative ICMP data length

The -b/--size handler checks the lower bound after casting the value to
unsigned long while checking the upper bound as a signed comparison.  A
negative argument such as "-b -65536" therefore satisfies both checks.
The value is then truncated to an undersized icmp_data_size, which later
serves as the size of the ICMP send buffer, so building the packet
overflows that buffer.

Compare the size as a signed long against both bounds so negative values
are rejected.

Reported-by: Christopher Kreft <Email@ChristopherKreft.de>

1 files changed, 1 insertions, 1 deletions

diff --git a/plugins-root/check_icmp.c b/plugins-root/check_icmp.c
index 8f5c1fe4..14e63c89 100644
--- a/plugins-root/check_icmp.c
+++ b/plugins-root/check_icmp.c
@@ -411,7 +411,7 @@ check_icmp_config_wrapper process_arguments(int argc, char **argv) {
                         switch (arg) {
                         case 'b': {
                                 long size = strtol(optarg, NULL, 0);
-                                if ((unsigned long)size >= (sizeof(struct icmp) + sizeof(struct icmp_ping_data)) &&
+                                if (size >= (long)(sizeof(struct icmp) + sizeof(struct icmp_ping_data)) &&
                                         size < MAX_PING_DATA) {
                                         result.config.icmp_data_size = (unsigned short)size;
                                 } else {