CVE-2017-13687/CHDLC: Improve bounds and length checks.

[tcpdump] / print-mobility.c

diff --git a/print-mobility.c b/print-mobility.c
index d08984d168626ff0f2aab510389bdaf4c2d88e52..71cc85b5bb05d5c490cbb726371e3358149cbb80 100644 (file)
--- a/print-mobility.c
+++ b/print-mobility.c
@@ -27,17 +27,20 @@
  * SUCH DAMAGE.
  */
 
+/* \summary: IPv6 mobility printer */
+
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
 
-#ifdef INET6
-#include <tcpdump-stdinc.h>
+#include <netdissect-stdinc.h>
 
 #include "ip6.h"
-#include "interface.h"
+#include "netdissect.h"
 #include "addrtoname.h"
-#include "extract.h"           /* must come after interface.h */
+#include "extract.h"
+
+static const char tstr[] = "[|MOBILITY]";
 
 /* Mobility header */
 struct ip6_mobility {
@@ -106,7 +109,7 @@ static const unsigned ip6m_hdrlen[IP6M_MAX + 1] = {
 #define IP6MOPT_AUTH          0x5      /* Binding Authorization Data */
 #define IP6MOPT_AUTH_MINLEN    12
 
-static void
+static int
 mobility_opt_print(netdissect_options *ndo,
                    const u_char *bp, const unsigned len)
 {
@@ -180,10 +183,10 @@ mobility_opt_print(netdissect_options *ndo,
                        break;
                }
        }
-       return;
+       return 0;
 
 trunc:
-       ND_PRINT((ndo, "[trunc] "));
+       return 1;
 }
 
 /*
@@ -237,7 +240,7 @@ mobility_print(netdissect_options *ndo,
        case IP6M_HOME_TEST_INIT:
        case IP6M_CAREOF_TEST_INIT:
                hlen = IP6M_MINLEN;
-               if (ndo->ndo_vflag) {
+               if (ndo->ndo_vflag) {
                        ND_TCHECK2(*mh, hlen + 8);
                        ND_PRINT((ndo, " %s Init Cookie=%08x:%08x",
                               type == IP6M_HOME_TEST_INIT ? "Home" : "Care-of",
@@ -251,7 +254,7 @@ mobility_print(netdissect_options *ndo,
                ND_TCHECK(mh->ip6m_data16[0]);
                ND_PRINT((ndo, " nonce id=0x%x", EXTRACT_16BITS(&mh->ip6m_data16[0])));
                hlen = IP6M_MINLEN;
-               if (ndo->ndo_vflag) {
+               if (ndo->ndo_vflag) {
                        ND_TCHECK2(*mh, hlen + 8);
                        ND_PRINT((ndo, " %s Init Cookie=%08x:%08x",
                               type == IP6M_HOME_TEST ? "Home" : "Care-of",
@@ -259,7 +262,7 @@ mobility_print(netdissect_options *ndo,
                               EXTRACT_32BITS(&bp[hlen + 4])));
                }
                hlen += 8;
-               if (ndo->ndo_vflag) {
+               if (ndo->ndo_vflag) {
                        ND_TCHECK2(*mh, hlen + 8);
                        ND_PRINT((ndo, " %s Keygen Token=%08x:%08x",
                               type == IP6M_HOME_TEST ? "Home" : "Care-of",
@@ -321,13 +324,13 @@ mobility_print(netdissect_options *ndo,
                return(mhlen);
                break;
        }
-       if (ndo->ndo_vflag)
-               mobility_opt_print(ndo, &bp[hlen], mhlen - hlen);
+       if (ndo->ndo_vflag)
+               if (mobility_opt_print(ndo, &bp[hlen], mhlen - hlen))
+                       goto trunc;;
 
        return(mhlen);
 
  trunc:
-       ND_PRINT((ndo, "[|MOBILITY]"));
+       ND_PRINT((ndo, "%s", tstr));
        return(mhlen);
 }
-#endif /* INET6 */