CVE-2016-7924/Add some bounds checks.

[tcpdump] / print-bootp.c

diff --git a/print-bootp.c b/print-bootp.c
index 7f42492d4188d29446c2ddf418a575caa87adfaf..d6be1d5b631a509f6067adce944713850d076b4e 100644 (file)
--- a/print-bootp.c
+++ b/print-bootp.c
@@ -17,20 +17,19 @@
  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
- *
- * Format and print bootp packets.
  */
 
-#define NETDISSECT_REWORKED
+/* \summary: BOOTP and IPv4 DHCP printer */
+
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
 
-#include <tcpdump-stdinc.h>
+#include <netdissect-stdinc.h>
 
 #include <string.h>
 
-#include "interface.h"
+#include "netdissect.h"
 #include "addrtoname.h"
 #include "extract.h"
 
@@ -195,6 +194,8 @@ struct bootp {
 /* RFC 3442 */
 #define TAG_CLASSLESS_STATIC_RT        ((uint8_t) 121)
 #define TAG_CLASSLESS_STA_RT_MS        ((uint8_t) 249)
+/* RFC 5859 - TFTP Server Address Option for DHCPv4 */
+#define        TAG_TFTP_SERVER_ADDRESS ((uint8_t) 150)
 /* ftp://ftp.isi.edu/.../assignments/bootp-dhcp-extensions */
 #define        TAG_SLP_NAMING_AUTH     ((uint8_t)  80)
 #define        TAG_CLIENT_FQDN         ((uint8_t)  81)
@@ -211,8 +212,9 @@ struct bootp {
 #define        TAG_CLIENT_GUID         ((uint8_t)  97)
 #define        TAG_LDAP_URL            ((uint8_t)  95)
 #define        TAG_6OVER4              ((uint8_t)  96)
-#define        TAG_PRINTER_NAME        ((uint8_t) 100)
-#define        TAG_MDHCP_SERVER        ((uint8_t) 101)
+/* RFC 4833, TZ codes */
+#define        TAG_TZ_PCODE            ((uint8_t) 100)
+#define        TAG_TZ_TCODE            ((uint8_t) 101)
 #define        TAG_IPX_COMPAT          ((uint8_t) 110)
 #define        TAG_NETINFO_PARENT      ((uint8_t) 112)
 #define        TAG_NETINFO_PARENT_TAG  ((uint8_t) 113)
@@ -220,6 +222,7 @@ struct bootp {
 #define        TAG_FAILOVER            ((uint8_t) 115)
 #define        TAG_EXTENDED_REQUEST    ((uint8_t) 126)
 #define        TAG_EXTENDED_OPTION     ((uint8_t) 127)
+#define TAG_MUDURL              ((uint8_t) 161)
 
 /* DHCP Message types (values for TAG_DHCP_MESSAGE option) */
 #define DHCPDISCOVER   1
@@ -500,6 +503,8 @@ static const struct tok tag2str[] = {
 /* RFC 3442 */
        { TAG_CLASSLESS_STATIC_RT, "$Classless-Static-Route" },
        { TAG_CLASSLESS_STA_RT_MS, "$Classless-Static-Route-Microsoft" },
+/* RFC 5859 - TFTP Server Address Option for DHCPv4 */
+       { TAG_TFTP_SERVER_ADDRESS, "iTFTP-Server-Address" },
 /* http://www.iana.org/assignments/bootp-dhcp-extensions/index.htm */
        { TAG_SLP_NAMING_AUTH,  "aSLP-NA" },
        { TAG_CLIENT_FQDN,      "$FQDN" },
@@ -516,13 +521,14 @@ static const struct tok tag2str[] = {
        { TAG_CLIENT_GUID,      "bGUID" },      /* XXX 'b' */
        { TAG_LDAP_URL,         "aLDAP" },
        { TAG_6OVER4,           "i6o4" },
-       { TAG_PRINTER_NAME,     "aPRTR" },
-       { TAG_MDHCP_SERVER,     "bMDHCP" },     /* XXX 'b' */
+       { TAG_TZ_PCODE,         "aPOSIX-TZ" },
+       { TAG_TZ_TCODE,         "aTZ-Name" },
        { TAG_IPX_COMPAT,       "bIPX" },       /* XXX 'b' */
        { TAG_NETINFO_PARENT,   "iNI" },
        { TAG_NETINFO_PARENT_TAG, "aNITAG" },
        { TAG_URL,              "aURL" },
        { TAG_FAILOVER,         "bFAIL" },      /* XXX 'b' */
+       { TAG_MUDURL,           "aMUD-URL" },
        { 0, NULL }
 };
 /* 2-byte extended tags */
@@ -847,7 +853,7 @@ rfc1048_print(netdissect_options *ndo,
 
                        case TAG_CLIENT_ID:
                            {
-                               int type;
+                               int type;
 
                                /* this option should be at least 1 byte long */
                                if (len < 1) {
@@ -903,7 +909,8 @@ rfc1048_print(netdissect_options *ndo,
                                        case AGENT_SUBOPTION_CIRCUIT_ID: /* fall through */
                                        case AGENT_SUBOPTION_REMOTE_ID:
                                        case AGENT_SUBOPTION_SUBSCRIBER_ID:
-                                               fn_printn(ndo, bp, suboptlen, NULL);
+                                               if (fn_printn(ndo, bp, suboptlen, ndo->ndo_snapend))
+                                                       goto trunc;
                                                break;
 
                                        default:
@@ -992,7 +999,7 @@ rfc1048_print(netdissect_options *ndo,
                                                break;
                                        }
                                        if (len < suboptlen) {
-                                               ND_PRINT((ndo, "ERROR: malformed option"));
+                                               ND_PRINT((ndo, "ERROR: invalid option"));
                                                bp += len;
                                                len = 0;
                                                break;