Fix potential (but not actual) buffer overflow risk.

[tcpdump] / print-atalk.c

diff --git a/print-atalk.c b/print-atalk.c
index 30ae8b4edd72876d097bb2848ed66c263d57356d..a075b189e5f14f03e506e7135047fc1eb7d9e080 100644 (file)
--- a/print-atalk.c
+++ b/print-atalk.c
@@ -22,24 +22,19 @@
  */
 
 #ifndef lint
  */
 
 #ifndef lint

-static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/tcpdump/print-atalk.c,v 1.67 2001-07-05 18:54:14 guy Exp $ (LBL)";
+static const char rcsid[] _U_ =
+    "@(#) $Header: /tcpdump/master/tcpdump/print-atalk.c,v 1.81 2004-05-01 09:41:50 hannes Exp $ (LBL)";

 #endif
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
 
 #endif
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
 

-#include <sys/param.h>
-#include <sys/time.h>
-#include <sys/socket.h>
-
-#include <netinet/in.h>
+#include <tcpdump-stdinc.h>

 
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>

-#include <netdb.h>             /* for MAXHOSTNAMELEN on some platforms */

 #include <pcap.h>
 
 #include "interface.h"
 #include <pcap.h>
 
 #include "interface.h"


@@ -86,41 +81,38 @@ static const char *ddpskt_string(int);
 /*
  * Print LLAP packets received on a physical LocalTalk interface.
  */
 /*
  * Print LLAP packets received on a physical LocalTalk interface.
  */

-void
-ltalk_if_print(u_char *user, const struct pcap_pkthdr *h, const u_char *p)
+u_int
+ltalk_if_print(const struct pcap_pkthdr *h, const u_char *p)

 {
 {

-       snapend = p + h->caplen;
-       ++infodelay;
-       ts_print(&h->ts);
-       llap_print(p, h->caplen);
-       if(xflag)
-               default_print(p, h->caplen);
-       putchar('\n');
-       --infodelay;
-       if (infoprint)
-               info(0);
+       return (llap_print(p, h->caplen));

 }
 
 /*
  * Print AppleTalk LLAP packets.
  */
 }
 
 /*
  * Print AppleTalk LLAP packets.
  */

-void
+u_int

 llap_print(register const u_char *bp, u_int length)
 {
        register const struct LAP *lp;
        register const struct atDDP *dp;
        register const struct atShortDDP *sdp;
        u_short snet;
 llap_print(register const u_char *bp, u_int length)
 {
        register const struct LAP *lp;
        register const struct atDDP *dp;
        register const struct atShortDDP *sdp;
        u_short snet;

+       u_int hdrlen;

 
 

-       lp = (struct LAP *)bp;
+       if (length < sizeof(*lp)) {
+               (void)printf(" [|llap %u]", length);
+               return (length);
+       }
+       lp = (const struct LAP *)bp;

        bp += sizeof(*lp);
        length -= sizeof(*lp);
        bp += sizeof(*lp);
        length -= sizeof(*lp);

+       hdrlen = sizeof(*lp);

        switch (lp->type) {
 
        case lapShortDDP:
                if (length < ddpSSize) {
        switch (lp->type) {
 
        case lapShortDDP:
                if (length < ddpSSize) {

-                       (void)printf(" [|sddp %d]", length);
-                       return;
+                       (void)printf(" [|sddp %u]", length);
+                       return (length);

                }
                sdp = (const struct atShortDDP *)bp;
                printf("%s.%s",
                }
                sdp = (const struct atShortDDP *)bp;
                printf("%s.%s",


@@ -129,13 +121,14 @@ llap_print(register const u_char *bp, u_int length)
                    ataddr_string(0, lp->dst), ddpskt_string(sdp->dstSkt));
                bp += ddpSSize;
                length -= ddpSSize;
                    ataddr_string(0, lp->dst), ddpskt_string(sdp->dstSkt));
                bp += ddpSSize;
                length -= ddpSSize;

+               hdrlen += ddpSSize;

                ddp_print(bp, length, sdp->type, 0, lp->src, sdp->srcSkt);
                break;
 
        case lapDDP:
                if (length < ddpSize) {
                ddp_print(bp, length, sdp->type, 0, lp->src, sdp->srcSkt);
                break;
 
        case lapDDP:
                if (length < ddpSize) {

-                       (void)printf(" [|ddp %d]", length);
-                       return;
+                       (void)printf(" [|ddp %u]", length);
+                       return (length);

                }
                dp = (const struct atDDP *)bp;
                snet = EXTRACT_16BITS(&dp->srcNet);
                }
                dp = (const struct atDDP *)bp;
                snet = EXTRACT_16BITS(&dp->srcNet);


@@ -146,6 +139,7 @@ llap_print(register const u_char *bp, u_int length)
                    ddpskt_string(dp->dstSkt));
                bp += ddpSize;
                length -= ddpSize;
                    ddpskt_string(dp->dstSkt));
                bp += ddpSize;
                length -= ddpSize;

+               hdrlen += ddpSize;

                ddp_print(bp, length, dp->type, snet, dp->srcNode, dp->srcSkt);
                break;
 
                ddp_print(bp, length, dp->type, snet, dp->srcNode, dp->srcSkt);
                break;
 


@@ -156,10 +150,11 @@ llap_print(register const u_char *bp, u_int length)
 #endif
 
        default:
 #endif
 
        default:

-               printf("%d > %d at-lap#%d %d",
+               printf("%d > %d at-lap#%d %u",

                    lp->src, lp->dst, lp->type, length);
                break;
        }
                    lp->src, lp->dst, lp->type, length);
                break;
        }

+       return (hdrlen);

 }
 
 /*
 }
 
 /*


@@ -173,15 +168,18 @@ atalk_print(register const u_char *bp, u_int length)
        register const struct atDDP *dp;
        u_short snet;
 
        register const struct atDDP *dp;
        u_short snet;
 

+        if(!eflag)
+            printf("AT ");
+

        if (length < ddpSize) {
        if (length < ddpSize) {

-         (void)printf(" [|ddp %d]", length);
-         return;
+               (void)printf(" [|ddp %u]", length);
+               return;

        }
        dp = (const struct atDDP *)bp;
        snet = EXTRACT_16BITS(&dp->srcNet);
        printf("%s.%s", ataddr_string(snet, dp->srcNode),
               ddpskt_string(dp->srcSkt));
        }
        dp = (const struct atDDP *)bp;
        snet = EXTRACT_16BITS(&dp->srcNet);
        printf("%s.%s", ataddr_string(snet, dp->srcNode),
               ddpskt_string(dp->srcSkt));

-       printf(" > %s.%s:",
+       printf(" > %s.%s: ",

               ataddr_string(EXTRACT_16BITS(&dp->dstNet), dp->dstNode),
               ddpskt_string(dp->dstSkt));
        bp += ddpSize;
               ataddr_string(EXTRACT_16BITS(&dp->dstNet), dp->dstNode),
               ddpskt_string(dp->dstSkt));
        bp += ddpSize;


@@ -199,9 +197,10 @@ aarp_print(register const u_char *bp, u_int length)
 
        printf("aarp ");
        ap = (const struct aarp *)bp;
 
        printf("aarp ");
        ap = (const struct aarp *)bp;

-       if (ntohs(ap->htype) == 1 && ntohs(ap->ptype) == ETHERTYPE_ATALK &&
+       if (EXTRACT_16BITS(&ap->htype) == 1 &&
+           EXTRACT_16BITS(&ap->ptype) == ETHERTYPE_ATALK &&

            ap->halen == 6 && ap->palen == 4 )
            ap->halen == 6 && ap->palen == 4 )

-               switch (ntohs(ap->op)) {
+               switch (EXTRACT_16BITS(&ap->op)) {

 
                case 1:                         /* request */
                        (void)printf("who-has %s tell %s",
 
                case 1:                         /* request */
                        (void)printf("who-has %s tell %s",


@@ -210,7 +209,7 @@ aarp_print(register const u_char *bp, u_int length)
 
                case 2:                         /* response */
                        (void)printf("reply %s is-at %s",
 
                case 2:                         /* response */
                        (void)printf("reply %s is-at %s",

-                           AT(pdaddr), etheraddr_string(ap->hdaddr));
+                           AT(psaddr), etheraddr_string(ap->hsaddr));

                        return;
 
                case 3:                         /* probe (oy!) */
                        return;
 
                case 3:                         /* probe (oy!) */


@@ -219,8 +218,8 @@ aarp_print(register const u_char *bp, u_int length)
                        return;
                }
        (void)printf("len %u op %u htype %u ptype %#x halen %u palen %u",
                        return;
                }
        (void)printf("len %u op %u htype %u ptype %#x halen %u palen %u",

-           length, ntohs(ap->op), ntohs(ap->htype), ntohs(ap->ptype),
-           ap->halen, ap->palen);
+           length, EXTRACT_16BITS(&ap->op), EXTRACT_16BITS(&ap->htype),
+           EXTRACT_16BITS(&ap->ptype), ap->halen, ap->palen);

 }
 
 /*
 }
 
 /*


@@ -241,6 +240,10 @@ ddp_print(register const u_char *bp, register u_int length, register int t,
                atp_print((const struct atATP *)bp, length);
                break;
 
                atp_print((const struct atATP *)bp, length);
                break;
 

+       case ddpEIGRP:
+               eigrp_print(bp, length);
+               break;
+

        default:
                (void)printf(" at-%s %d", tok2str(type2str, NULL, t), length);
                break;
        default:
                (void)printf(" at-%s %d", tok2str(type2str, NULL, t), length);
                break;


@@ -258,6 +261,10 @@ atp_print(register const struct atATP *ap, u_int length)
                fputs(tstr, stdout);
                return;
        }
                fputs(tstr, stdout);
                return;
        }

+       if (length < sizeof(*ap)) {
+               (void)printf(" [|atp %u]", length);
+               return;
+       }

        length -= sizeof(*ap);
        switch (ap->control & 0xc0) {
 
        length -= sizeof(*ap);
        switch (ap->control & 0xc0) {
 


@@ -269,7 +276,7 @@ atp_print(register const struct atATP *ap, u_int length)
                atp_bitmap_print(ap->bitmap);
 
                if (length != 0)
                atp_bitmap_print(ap->bitmap);
 
                if (length != 0)

-                       (void)printf(" [len=%d]", length);
+                       (void)printf(" [len=%u]", length);

 
                switch (ap->control & (atpEOM|atpSTS)) {
                case atpEOM:
 
                switch (ap->control & (atpEOM|atpSTS)) {
                case atpEOM:


@@ -285,7 +292,7 @@ atp_print(register const struct atATP *ap, u_int length)
                break;
 
        case atpRspCode:
                break;
 
        case atpRspCode:

-               (void)printf(" atp-resp%s%d:%d (%d)",
+               (void)printf(" atp-resp%s%d:%d (%u)",

                             ap->control & atpEOM? "*" : " ",
                             EXTRACT_16BITS(&ap->transID), ap->bitmap, length);
                switch (ap->control & (atpXO|atpSTS)) {
                             ap->control & atpEOM? "*" : " ",
                             EXTRACT_16BITS(&ap->transID), ap->bitmap, length);
                switch (ap->control & (atpXO|atpSTS)) {


@@ -308,7 +315,7 @@ atp_print(register const struct atATP *ap, u_int length)
 
                /* length should be zero */
                if (length)
 
                /* length should be zero */
                if (length)

-                       (void)printf(" [len=%d]", length);
+                       (void)printf(" [len=%u]", length);

 
                /* there shouldn't be any control flags */
                if (ap->control & (atpXO|atpEOM|atpSTS)) {
 
                /* there shouldn't be any control flags */
                if (ap->control & (atpXO|atpEOM|atpSTS)) {


@@ -330,7 +337,7 @@ atp_print(register const struct atATP *ap, u_int length)
                break;
 
        default:
                break;
 
        default:

-               (void)printf(" atp-0x%x  %d (%d)", ap->control,
+               (void)printf(" atp-0x%x  %d (%u)", ap->control,

                             EXTRACT_16BITS(&ap->transID), length);
                break;
        }
                             EXTRACT_16BITS(&ap->transID), length);
                break;
        }


@@ -375,14 +382,19 @@ nbp_print(register const struct atNBP *np, u_int length, register u_short snet,
          register u_char snode, register u_char skt)
 {
        register const struct atNBPtuple *tp =
          register u_char snode, register u_char skt)
 {
        register const struct atNBPtuple *tp =

-                       (struct atNBPtuple *)((u_char *)np + nbpHeaderSize);
+               (const struct atNBPtuple *)((u_char *)np + nbpHeaderSize);

        int i;
        const u_char *ep;
 
        int i;
        const u_char *ep;
 

+       if (length < nbpHeaderSize) {
+               (void)printf(" truncated-nbp %u", length);
+               return;
+       }
+

        length -= nbpHeaderSize;
        if (length < 8) {
                /* must be room for at least one tuple */
        length -= nbpHeaderSize;
        if (length < 8) {
                /* must be room for at least one tuple */

-               (void)printf(" truncated-nbp %d", length + nbpHeaderSize);
+               (void)printf(" truncated-nbp %u", length + nbpHeaderSize);

                return;
        }
        /* ep points to end of available data */
                return;
        }
        /* ep points to end of available data */


@@ -427,7 +439,7 @@ nbp_print(register const struct atNBP *np, u_int length, register u_short snet,
                break;
 
        default:
                break;
 
        default:

-               (void)printf(" nbp-0x%x  %d (%d)", np->control, np->id,
+               (void)printf(" nbp-0x%x  %d (%u)", np->control, np->id,

                                length);
                break;
        }
                                length);
                break;
        }


@@ -451,7 +463,7 @@ print_cstring(register const char *cp, register const u_char *ep)
                return (0);
        }
        while ((int)--length >= 0) {
                return (0);
        }
        while ((int)--length >= 0) {

-               if (cp >= (char *)ep) {
+               if (cp >= (const char *)ep) {

                        fputs(tstr, stdout);
                        return (0);
                }
                        fputs(tstr, stdout);
                        return (0);
                }


@@ -528,7 +540,7 @@ ataddr_string(u_short atnet, u_char athost)
 {
        register struct hnamemem *tp, *tp2;
        register int i = (atnet << 8) | athost;
 {
        register struct hnamemem *tp, *tp2;
        register int i = (atnet << 8) | athost;

-       char nambuf[MAXHOSTNAMELEN + 20];
+       char nambuf[256+1];

        static int first = 1;
        FILE *fp;
 
        static int first = 1;
        FILE *fp;
 


@@ -539,26 +551,24 @@ ataddr_string(u_short atnet, u_char athost)
        if (first && (first = 0, !nflag)
            && (fp = fopen("/etc/atalk.names", "r"))) {
                char line[256];
        if (first && (first = 0, !nflag)
            && (fp = fopen("/etc/atalk.names", "r"))) {
                char line[256];

-               int i1, i2, i3;
+               int i1, i2;

 
                while (fgets(line, sizeof(line), fp)) {
                        if (line[0] == '\n' || line[0] == 0 || line[0] == '#')
                                continue;
 
                while (fgets(line, sizeof(line), fp)) {
                        if (line[0] == '\n' || line[0] == 0 || line[0] == '#')
                                continue;

-                       if (sscanf(line, "%d.%d.%d %256s", &i1, &i2, &i3,
-                                    nambuf) == 4)
+                       if (sscanf(line, "%d.%d %256s", &i1, &i2, nambuf) == 3)

                                /* got a hostname. */
                                /* got a hostname. */

-                               i3 |= ((i1 << 8) | i2) << 8;
-                       else if (sscanf(line, "%d.%d %256s", &i1, &i2,
-                                       nambuf) == 3)
+                               i2 |= (i1 << 8);
+                       else if (sscanf(line, "%d %256s", &i1, nambuf) == 2)

                                /* got a net name */
                                /* got a net name */

-                               i3 = (((i1 << 8) | i2) << 8) | 255;
+                               i2 = (i1 << 8) | 255;

                        else
                                continue;
 
                        else
                                continue;
 

-                       for (tp = &hnametable[i3 & (HASHNAMESIZE-1)];
+                       for (tp = &hnametable[i2 & (HASHNAMESIZE-1)];

                             tp->nxt; tp = tp->nxt)
                                ;
                             tp->nxt; tp = tp->nxt)
                                ;

-                       tp->addr = i3;
+                       tp->addr = i2;

                        tp->nxt = newhnamemem();
                        tp->name = strdup(nambuf);
                }
                        tp->nxt = newhnamemem();
                        tp->name = strdup(nambuf);
                }


@@ -584,11 +594,9 @@ ataddr_string(u_short atnet, u_char athost)
        tp->addr = (atnet << 8) | athost;
        tp->nxt = newhnamemem();
        if (athost != 255)
        tp->addr = (atnet << 8) | athost;
        tp->nxt = newhnamemem();
        if (athost != 255)

-               (void)snprintf(nambuf, sizeof(nambuf), "%d.%d.%d",
-                   atnet >> 8, atnet & 0xff, athost);
+               (void)snprintf(nambuf, sizeof(nambuf), "%d.%d", atnet, athost);

        else
        else

-               (void)snprintf(nambuf, sizeof(nambuf), "%d.%d", atnet >> 8,
-                   atnet & 0xff);
+               (void)snprintf(nambuf, sizeof(nambuf), "%d", atnet);

        tp->name = strdup(nambuf);
 
        return (tp->name);
        tp->name = strdup(nambuf);
 
        return (tp->name);