Handle very large -f files by rejecting them.

[tcpdump] / print-dhcp6.c

diff --git a/print-dhcp6.c b/print-dhcp6.c
index e4a9f759604a7813d8e5a8229d9933cc535dd7e9..cbb6d84a0588b8204f1c930a089136925e46197f 100644 (file)
--- a/print-dhcp6.c
+++ b/print-dhcp6.c
@@ -304,6 +304,7 @@ dhcp6opt_print(netdissect_options *ndo,
                        goto trunc;
                opttype = EXTRACT_16BITS(&dh6o->dh6opt_type);
                ND_PRINT((ndo, " (%s", tok2str(dh6opt_str, "opt_%u", opttype)));
+               ND_TCHECK2(*(cp + sizeof(*dh6o)), optlen);
                switch (opttype) {
                case DH6OPT_CLIENTID:
                case DH6OPT_SERVERID:
@@ -517,6 +518,10 @@ dhcp6opt_print(netdissect_options *ndo,
                        ND_PRINT((ndo, "...)"));
                        break;
                case DH6OPT_RECONF_MSG:
+                       if (optlen != 1) {
+                               ND_PRINT((ndo, " ?)"));
+                               break;
+                       }
                        tp = (const u_char *)(dh6o + 1);
                        switch (*tp) {
                        case DH6_RENEW:
@@ -731,7 +736,7 @@ dhcp6opt_print(netdissect_options *ndo,
                        while (remain_len && *tp) {
                                label_len =  *tp++;
                                if (label_len < remain_len - 1) {
-                                       ND_PRINT((ndo, "%.*s", label_len, tp));
+                                       (void)fn_printn(ndo, tp, label_len, NULL);
                                        tp += label_len;
                                        remain_len -= (label_len + 1);
                                        if(*tp) ND_PRINT((ndo, "."));
@@ -745,14 +750,15 @@ dhcp6opt_print(netdissect_options *ndo,
                case DH6OPT_NEW_POSIX_TIMEZONE: /* all three of these options */
                case DH6OPT_NEW_TZDB_TIMEZONE:  /* are encoded similarly */
                case DH6OPT_MUDURL:             /* although GMT might not work */
-                       if ( optlen < 5 ) {
-                         ND_PRINT((ndo," ?)"));
-                         break;
+                       if (optlen < 5) {
+                               ND_PRINT((ndo, " ?)"));
+                               break;
                        }
-                       tp=(u_char *) (dh6o + 1);
-                       ND_PRINT((ndo,"=%.*s)",(int) optlen,tp));
+                       tp = (const u_char *)(dh6o + 1);
+                       ND_PRINT((ndo, "="));
+                       (void)fn_printn(ndo, tp, (u_int)optlen, NULL);
+                       ND_PRINT((ndo, ")"));
                        break;
-                   
 
                default:
                        ND_PRINT((ndo, ")"));