Bounds-check the individual components of a SAP reply.

[tcpdump] / print-frag6.c

diff --git a/print-frag6.c b/print-frag6.c
index 4350951045de3bc2061df4e18c0dbb725dae0fcf..1fd16f99270ee6250ef9a672c57ab92732fc02a4 100644 (file)
--- a/print-frag6.c
+++ b/print-frag6.c
@@ -19,6 +19,10 @@
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 
+#ifndef lint
+static const char rcsid[] _U_ =
+    "@(#) $Header: /tcpdump/master/tcpdump/print-frag6.c,v 1.19.2.1 2005-04-20 22:33:21 guy Exp $";
+#endif
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
@@ -36,23 +40,15 @@
 #include "addrtoname.h"
 #include "extract.h"
 
-#ifndef lint
-static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/tcpdump/print-frag6.c,v 1.17 2003-11-15 00:39:23 guy Exp $";
-#endif
 int
 frag6_print(register const u_char *bp, register const u_char *bp2)
 {
        register const struct ip6_frag *dp;
        register const struct ip6_hdr *ip6;
-       register const u_char *ep;
 
        dp = (const struct ip6_frag *)bp;
        ip6 = (const struct ip6_hdr *)bp2;
 
-       /* 'ep' points to the end of available data. */
-       ep = snapend;
-
        TCHECK(dp->ip6f_offlg);
 
        if (vflag) {
@@ -71,7 +67,7 @@ frag6_print(register const u_char *bp, register const u_char *bp2)
 #if 1
        /* it is meaningless to decode non-first fragment */
        if ((EXTRACT_16BITS(&dp->ip6f_offlg) & IP6F_OFF_MASK) != 0)
-               return 65535;
+               return -1;
        else
 #endif
        {
@@ -80,7 +76,7 @@ frag6_print(register const u_char *bp, register const u_char *bp2)
        }
 trunc:
        fputs("[|frag]", stdout);
-       return 65535;
+       return -1;
 #undef TCHECK
 }
 #endif /* INET6 */