Don't run past the snaplength when printing a packet with a too-short LI.

[tcpdump] / print-icmp.c

diff --git a/print-icmp.c b/print-icmp.c
index a6c0811007e2b7f952ed083efe7b046a5f6902bc..36bff6a41214c217d54560c7ca46cd75f406f2a2 100644 (file)
--- a/print-icmp.c
+++ b/print-icmp.c
@@ -21,7 +21,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
 
 #ifndef lint
 static const char rcsid[] _U_ =

-    "@(#) $Header: /tcpdump/master/tcpdump/print-icmp.c,v 1.84 2006-12-12 10:48:43 hannes Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/tcpdump/print-icmp.c,v 1.87 2007-09-13 17:42:31 guy Exp $ (LBL)";

 #endif
 
 #ifdef HAVE_CONFIG_H
 #endif
 
 #ifdef HAVE_CONFIG_H


@@ -300,9 +300,6 @@ struct icmp_ext_t {
     u_int8_t icmp_ext_data[1];
 };
 
     u_int8_t icmp_ext_data[1];
 };
 

-struct icmp_mpls_ext_common_header_t {
-};
-

 struct icmp_mpls_ext_object_header_t {
     u_int8_t length[2];
     u_int8_t class_num;
 struct icmp_mpls_ext_object_header_t {
     u_int8_t length[2];
     u_int8_t class_num;


@@ -415,7 +412,7 @@ icmp_print(const u_char *bp, u_int plen, const u_char *bp2, int fragmented)
                case ICMP_UNREACH_NEEDFRAG:
                    {
                        register const struct mtu_discovery *mp;
                case ICMP_UNREACH_NEEDFRAG:
                    {
                        register const struct mtu_discovery *mp;

-                       mp = (struct mtu_discovery *)&dp->icmp_void;
+                       mp = (struct mtu_discovery *)(u_char *)&dp->icmp_void;

                        mtu = EXTRACT_16BITS(&mp->nexthopmtu);
                        if (mtu) {
                                (void)snprintf(buf, sizeof(buf),
                        mtu = EXTRACT_16BITS(&mp->nexthopmtu);
                        if (mtu) {
                                (void)snprintf(buf, sizeof(buf),


@@ -589,13 +586,24 @@ icmp_print(const u_char *bp, u_int plen, const u_char *bp2, int fragmented)
        }
 
         /*
        }
 
         /*

-         * Check if the extended ICMP header indicates that there is
-         * MPLS extension header present for the "interesting" ICMP types.
+         * Attempt to decode the MPLS extensions only for some ICMP types.

          */
          */

-        if (vflag >= 1 && plen > ICMP_EXTD_MINLEN &&
-            ext_dp->icmp_length && ICMP_MPLS_EXT_TYPE(dp->icmp_type)) {
+        if (vflag >= 1 && plen > ICMP_EXTD_MINLEN && ICMP_MPLS_EXT_TYPE(dp->icmp_type)) {

 
             TCHECK(*ext_dp);
 
             TCHECK(*ext_dp);

+
+            /*
+             * Check first if the mpls extension header shows a non-zero length.
+             * If the length field is not set then silently verify the checksum
+             * to check if an extension header is present. This is expedient,
+             * however not all implementations set the length field proper.
+             */
+            if (!ext_dp->icmp_length &&
+                in_cksum((const u_short *)&ext_dp->icmp_ext_version_res,
+                         plen - ICMP_EXTD_MINLEN, 0)) {
+                return;
+            }
+

             printf("\n\tMPLS extension v%u",
                    ICMP_MPLS_EXT_EXTRACT_VERSION(*(ext_dp->icmp_ext_version_res)));
             
             printf("\n\tMPLS extension v%u",
                    ICMP_MPLS_EXT_EXTRACT_VERSION(*(ext_dp->icmp_ext_version_res)));
             


@@ -609,8 +617,10 @@ icmp_print(const u_char *bp, u_int plen, const u_char *bp2, int fragmented)
             }
 
             hlen = plen - ICMP_EXTD_MINLEN;
             }
 
             hlen = plen - ICMP_EXTD_MINLEN;

-            printf(", checksum 0x%04x (unverified), length %u", /* FIXME */
+            printf(", checksum 0x%04x (%scorrect), length %u",

                    EXTRACT_16BITS(ext_dp->icmp_ext_checksum),
                    EXTRACT_16BITS(ext_dp->icmp_ext_checksum),

+                   in_cksum((const u_short *)&ext_dp->icmp_ext_version_res,
+                            plen - ICMP_EXTD_MINLEN, 0) ? "in" : "",

                    hlen);
 
             hlen -= 4; /* subtract common header size */
                    hlen);
 
             hlen -= 4; /* subtract common header size */