(for 4.9.3) LDP: Add some missing bounds checks

[tcpdump] / print-ospf.c

diff --git a/print-ospf.c b/print-ospf.c
index 03df0598e49aa21128abd4d7cf9bbbf45f4a5102..4c09912a98193125f392284d2a2fd2ff1789e25c 100644 (file)
--- a/print-ospf.c
+++ b/print-ospf.c
@@ -706,7 +706,7 @@ ospf_print_lsa(netdissect_options *ndo,
                while ((const u_char *)lp < ls_end) {
                        register uint32_t ul;
 
                while ((const u_char *)lp < ls_end) {
                        register uint32_t ul;
 

-                       ND_TCHECK(*lp);
+                       ND_TCHECK_32BITS(lp);

                        ul = EXTRACT_32BITS(lp);
                         topology = (ul & SLA_MASK_TOS) >> SLA_SHIFT_TOS;
                        ND_PRINT((ndo, "\n\t\ttopology %s (%u) metric %d",
                        ul = EXTRACT_32BITS(lp);
                         topology = (ul & SLA_MASK_TOS) >> SLA_SHIFT_TOS;
                        ND_PRINT((ndo, "\n\t\ttopology %s (%u) metric %d",


@@ -723,7 +723,7 @@ ospf_print_lsa(netdissect_options *ndo,
                while ((const u_char *)lp < ls_end) {
                        register uint32_t ul;
 
                while ((const u_char *)lp < ls_end) {
                        register uint32_t ul;
 

-                       ND_TCHECK(*lp);
+                       ND_TCHECK_32BITS(lp);

                        ul = EXTRACT_32BITS(lp);
                         topology = (ul & SLA_MASK_TOS) >> SLA_SHIFT_TOS;
                        ND_PRINT((ndo, "\n\t\ttopology %s (%u) metric %d",
                        ul = EXTRACT_32BITS(lp);
                         topology = (ul & SLA_MASK_TOS) >> SLA_SHIFT_TOS;
                        ND_PRINT((ndo, "\n\t\ttopology %s (%u) metric %d",


@@ -996,6 +996,7 @@ ospf_decode_v2(netdissect_options *ndo,
                break;
 
        case OSPF_TYPE_HELLO:
                break;
 
        case OSPF_TYPE_HELLO:

+               ND_TCHECK(op->ospf_hello.hello_options);

                ND_PRINT((ndo, "\n\tOptions [%s]",
                          bittok2str(ospf_option_values,"none",op->ospf_hello.hello_options)));
 
                ND_PRINT((ndo, "\n\tOptions [%s]",
                          bittok2str(ospf_option_values,"none",op->ospf_hello.hello_options)));