CVE-2017-13002/AODV: Add some missing bounds checks.

[tcpdump] / print-bootp.c

diff --git a/print-bootp.c b/print-bootp.c
index d6be1d5b631a509f6067adce944713850d076b4e..ce2ecac4f4228c8d59bc1fb320d0a4011944bf51 100644 (file)
--- a/print-bootp.c
+++ b/print-bootp.c
@@ -293,6 +293,7 @@ bootp_print(netdissect_options *ndo,
        ND_PRINT((ndo, "BOOTP/DHCP, %s",
                  tok2str(bootp_op_values, "unknown (0x%02x)", bp->bp_op)));
 
+       ND_TCHECK(bp->bp_hlen);
        if (bp->bp_htype == 1 && bp->bp_hlen == 6 && bp->bp_op == BOOTPREQUEST) {
                ND_TCHECK2(bp->bp_chaddr[0], 6);
                ND_PRINT((ndo, " from %s", etheraddr_string(ndo, bp->bp_chaddr)));
@@ -355,7 +356,8 @@ bootp_print(netdissect_options *ndo,
        ND_TCHECK2(bp->bp_sname[0], 1);         /* check first char only */
        if (*bp->bp_sname) {
                ND_PRINT((ndo, "\n\t  sname \""));
-               if (fn_print(ndo, bp->bp_sname, ndo->ndo_snapend)) {
+               if (fn_printztn(ndo, bp->bp_sname, (u_int)sizeof bp->bp_sname,
+                   ndo->ndo_snapend)) {
                        ND_PRINT((ndo, "\""));
                        ND_PRINT((ndo, "%s", tstr + 1));
                        return;
@@ -365,7 +367,8 @@ bootp_print(netdissect_options *ndo,
        ND_TCHECK2(bp->bp_file[0], 1);          /* check first char only */
        if (*bp->bp_file) {
                ND_PRINT((ndo, "\n\t  file \""));
-               if (fn_print(ndo, bp->bp_file, ndo->ndo_snapend)) {
+               if (fn_printztn(ndo, bp->bp_file, (u_int)sizeof bp->bp_file,
+                   ndo->ndo_snapend)) {
                        ND_PRINT((ndo, "\""));
                        ND_PRINT((ndo, "%s", tstr + 1));
                        return;
@@ -403,7 +406,7 @@ trunc:
  *     s - short (16 bits)
  *     b - period-seperated decimal bytes (variable length)
  *     x - colon-seperated hex bytes (variable length)
- *     a - ascii string (variable length)
+ *     a - ASCII string (variable length)
  *     B - on/off (8 bits)
  *     $ - special (explicit code to handle)
  */
@@ -421,7 +424,7 @@ static const struct tok tag2str[] = {
        { TAG_LPR_SERVER,       "iLPR-Server" },        /* lpr server (RFC1179) */
        { TAG_IMPRESS_SERVER,   "iIM" },        /* impress servers (Imagen) */
        { TAG_RLP_SERVER,       "iRL" },        /* resource location (RFC887) */
-       { TAG_HOSTNAME,         "aHostname" },  /* ascii hostname */
+       { TAG_HOSTNAME,         "aHostname" },  /* ASCII hostname */
        { TAG_BOOTSIZE,         "sBS" },        /* 512 byte blocks */
        { TAG_END,              " END" },
 /* RFC1497 tags */
@@ -701,7 +704,7 @@ rfc1048_print(netdissect_options *ndo,
                switch (c) {
 
                case 'a':
-                       /* ascii strings */
+                       /* ASCII strings */
                        ND_PRINT((ndo, "\""));
                        if (fn_printn(ndo, bp, len, ndo->ndo_snapend)) {
                                ND_PRINT((ndo, "\""));