Fix potential (but not actual) buffer overflow risk.

[tcpdump] / print-atalk.c

diff --git a/print-atalk.c b/print-atalk.c
index b497065480e77a28a9f63ab48fd21ef08a558856..a075b189e5f14f03e506e7135047fc1eb7d9e080 100644 (file)
--- a/print-atalk.c
+++ b/print-atalk.c
@@ -22,8 +22,8 @@
  */
 
 #ifndef lint
  */
 
 #ifndef lint

-static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/tcpdump/print-atalk.c,v 1.78 2002-12-19 09:39:11 guy Exp $ (LBL)";
+static const char rcsid[] _U_ =
+    "@(#) $Header: /tcpdump/master/tcpdump/print-atalk.c,v 1.81 2004-05-01 09:41:50 hannes Exp $ (LBL)";

 #endif
 
 #ifdef HAVE_CONFIG_H
 #endif
 
 #ifdef HAVE_CONFIG_H


@@ -99,14 +99,10 @@ llap_print(register const u_char *bp, u_int length)
        u_short snet;
        u_int hdrlen;
 
        u_short snet;
        u_int hdrlen;
 

-       /*
-        * Our packet is on a 4-byte boundary, as we're either called
-        * directly from a top-level link-layer printer (ltalk_if_print)
-        * or from the UDP printer.  The LLAP+DDP header is a multiple
-        * of 4 bytes in length, so the DDP payload is also on a 4-byte
-        * boundary, and we don't need to align it before calling
-        * "ddp_print()".
-        */
+       if (length < sizeof(*lp)) {
+               (void)printf(" [|llap %u]", length);
+               return (length);
+       }

        lp = (const struct LAP *)bp;
        bp += sizeof(*lp);
        length -= sizeof(*lp);
        lp = (const struct LAP *)bp;
        bp += sizeof(*lp);
        length -= sizeof(*lp);


@@ -115,7 +111,7 @@ llap_print(register const u_char *bp, u_int length)
 
        case lapShortDDP:
                if (length < ddpSSize) {
 
        case lapShortDDP:
                if (length < ddpSSize) {

-                       (void)printf(" [|sddp %d]", length);
+                       (void)printf(" [|sddp %u]", length);

                        return (length);
                }
                sdp = (const struct atShortDDP *)bp;
                        return (length);
                }
                sdp = (const struct atShortDDP *)bp;


@@ -131,7 +127,7 @@ llap_print(register const u_char *bp, u_int length)
 
        case lapDDP:
                if (length < ddpSize) {
 
        case lapDDP:
                if (length < ddpSize) {

-                       (void)printf(" [|ddp %d]", length);
+                       (void)printf(" [|ddp %u]", length);

                        return (length);
                }
                dp = (const struct atDDP *)bp;
                        return (length);
                }
                dp = (const struct atDDP *)bp;


@@ -154,7 +150,7 @@ llap_print(register const u_char *bp, u_int length)
 #endif
 
        default:
 #endif
 
        default:

-               printf("%d > %d at-lap#%d %d",
+               printf("%d > %d at-lap#%d %u",

                    lp->src, lp->dst, lp->type, length);
                break;
        }
                    lp->src, lp->dst, lp->type, length);
                break;
        }


@@ -172,15 +168,18 @@ atalk_print(register const u_char *bp, u_int length)
        register const struct atDDP *dp;
        u_short snet;
 
        register const struct atDDP *dp;
        u_short snet;
 

+        if(!eflag)
+            printf("AT ");
+

        if (length < ddpSize) {
        if (length < ddpSize) {

-               (void)printf(" [|ddp %d]", length);
+               (void)printf(" [|ddp %u]", length);

                return;
        }
        dp = (const struct atDDP *)bp;
        snet = EXTRACT_16BITS(&dp->srcNet);
        printf("%s.%s", ataddr_string(snet, dp->srcNode),
               ddpskt_string(dp->srcSkt));
                return;
        }
        dp = (const struct atDDP *)bp;
        snet = EXTRACT_16BITS(&dp->srcNet);
        printf("%s.%s", ataddr_string(snet, dp->srcNode),
               ddpskt_string(dp->srcSkt));

-       printf(" > %s.%s:",
+       printf(" > %s.%s: ",

               ataddr_string(EXTRACT_16BITS(&dp->dstNet), dp->dstNode),
               ddpskt_string(dp->dstSkt));
        bp += ddpSize;
               ataddr_string(EXTRACT_16BITS(&dp->dstNet), dp->dstNode),
               ddpskt_string(dp->dstSkt));
        bp += ddpSize;


@@ -210,7 +209,7 @@ aarp_print(register const u_char *bp, u_int length)
 
                case 2:                         /* response */
                        (void)printf("reply %s is-at %s",
 
                case 2:                         /* response */
                        (void)printf("reply %s is-at %s",

-                           AT(pdaddr), etheraddr_string(ap->hdaddr));
+                           AT(psaddr), etheraddr_string(ap->hsaddr));

                        return;
 
                case 3:                         /* probe (oy!) */
                        return;
 
                case 3:                         /* probe (oy!) */


@@ -241,6 +240,10 @@ ddp_print(register const u_char *bp, register u_int length, register int t,
                atp_print((const struct atATP *)bp, length);
                break;
 
                atp_print((const struct atATP *)bp, length);
                break;
 

+       case ddpEIGRP:
+               eigrp_print(bp, length);
+               break;
+

        default:
                (void)printf(" at-%s %d", tok2str(type2str, NULL, t), length);
                break;
        default:
                (void)printf(" at-%s %d", tok2str(type2str, NULL, t), length);
                break;


@@ -258,6 +261,10 @@ atp_print(register const struct atATP *ap, u_int length)
                fputs(tstr, stdout);
                return;
        }
                fputs(tstr, stdout);
                return;
        }

+       if (length < sizeof(*ap)) {
+               (void)printf(" [|atp %u]", length);
+               return;
+       }

        length -= sizeof(*ap);
        switch (ap->control & 0xc0) {
 
        length -= sizeof(*ap);
        switch (ap->control & 0xc0) {
 


@@ -269,7 +276,7 @@ atp_print(register const struct atATP *ap, u_int length)
                atp_bitmap_print(ap->bitmap);
 
                if (length != 0)
                atp_bitmap_print(ap->bitmap);
 
                if (length != 0)

-                       (void)printf(" [len=%d]", length);
+                       (void)printf(" [len=%u]", length);

 
                switch (ap->control & (atpEOM|atpSTS)) {
                case atpEOM:
 
                switch (ap->control & (atpEOM|atpSTS)) {
                case atpEOM:


@@ -285,7 +292,7 @@ atp_print(register const struct atATP *ap, u_int length)
                break;
 
        case atpRspCode:
                break;
 
        case atpRspCode:

-               (void)printf(" atp-resp%s%d:%d (%d)",
+               (void)printf(" atp-resp%s%d:%d (%u)",

                             ap->control & atpEOM? "*" : " ",
                             EXTRACT_16BITS(&ap->transID), ap->bitmap, length);
                switch (ap->control & (atpXO|atpSTS)) {
                             ap->control & atpEOM? "*" : " ",
                             EXTRACT_16BITS(&ap->transID), ap->bitmap, length);
                switch (ap->control & (atpXO|atpSTS)) {


@@ -308,7 +315,7 @@ atp_print(register const struct atATP *ap, u_int length)
 
                /* length should be zero */
                if (length)
 
                /* length should be zero */
                if (length)

-                       (void)printf(" [len=%d]", length);
+                       (void)printf(" [len=%u]", length);

 
                /* there shouldn't be any control flags */
                if (ap->control & (atpXO|atpEOM|atpSTS)) {
 
                /* there shouldn't be any control flags */
                if (ap->control & (atpXO|atpEOM|atpSTS)) {


@@ -330,7 +337,7 @@ atp_print(register const struct atATP *ap, u_int length)
                break;
 
        default:
                break;
 
        default:

-               (void)printf(" atp-0x%x  %d (%d)", ap->control,
+               (void)printf(" atp-0x%x  %d (%u)", ap->control,

                             EXTRACT_16BITS(&ap->transID), length);
                break;
        }
                             EXTRACT_16BITS(&ap->transID), length);
                break;
        }


@@ -380,14 +387,14 @@ nbp_print(register const struct atNBP *np, u_int length, register u_short snet,
        const u_char *ep;
 
        if (length < nbpHeaderSize) {
        const u_char *ep;
 
        if (length < nbpHeaderSize) {

-               (void)printf(" truncated-nbp %d", length);
+               (void)printf(" truncated-nbp %u", length);

                return;
        }
 
        length -= nbpHeaderSize;
        if (length < 8) {
                /* must be room for at least one tuple */
                return;
        }
 
        length -= nbpHeaderSize;
        if (length < 8) {
                /* must be room for at least one tuple */

-               (void)printf(" truncated-nbp %d", length + nbpHeaderSize);
+               (void)printf(" truncated-nbp %u", length + nbpHeaderSize);

                return;
        }
        /* ep points to end of available data */
                return;
        }
        /* ep points to end of available data */


@@ -432,7 +439,7 @@ nbp_print(register const struct atNBP *np, u_int length, register u_short snet,
                break;
 
        default:
                break;
 
        default:

-               (void)printf(" nbp-0x%x  %d (%d)", np->control, np->id,
+               (void)printf(" nbp-0x%x  %d (%u)", np->control, np->id,

                                length);
                break;
        }
                                length);
                break;
        }


@@ -533,7 +540,7 @@ ataddr_string(u_short atnet, u_char athost)
 {
        register struct hnamemem *tp, *tp2;
        register int i = (atnet << 8) | athost;
 {
        register struct hnamemem *tp, *tp2;
        register int i = (atnet << 8) | athost;

-       char nambuf[MAXHOSTNAMELEN + 20];
+       char nambuf[256+1];

        static int first = 1;
        FILE *fp;
 
        static int first = 1;
        FILE *fp;
 


@@ -544,26 +551,24 @@ ataddr_string(u_short atnet, u_char athost)
        if (first && (first = 0, !nflag)
            && (fp = fopen("/etc/atalk.names", "r"))) {
                char line[256];
        if (first && (first = 0, !nflag)
            && (fp = fopen("/etc/atalk.names", "r"))) {
                char line[256];

-               int i1, i2, i3;
+               int i1, i2;

 
                while (fgets(line, sizeof(line), fp)) {
                        if (line[0] == '\n' || line[0] == 0 || line[0] == '#')
                                continue;
 
                while (fgets(line, sizeof(line), fp)) {
                        if (line[0] == '\n' || line[0] == 0 || line[0] == '#')
                                continue;

-                       if (sscanf(line, "%d.%d.%d %256s", &i1, &i2, &i3,
-                                    nambuf) == 4)
+                       if (sscanf(line, "%d.%d %256s", &i1, &i2, nambuf) == 3)

                                /* got a hostname. */
                                /* got a hostname. */

-                               i3 |= ((i1 << 8) | i2) << 8;
-                       else if (sscanf(line, "%d.%d %256s", &i1, &i2,
-                                       nambuf) == 3)
+                               i2 |= (i1 << 8);
+                       else if (sscanf(line, "%d %256s", &i1, nambuf) == 2)

                                /* got a net name */
                                /* got a net name */

-                               i3 = (((i1 << 8) | i2) << 8) | 255;
+                               i2 = (i1 << 8) | 255;

                        else
                                continue;
 
                        else
                                continue;
 

-                       for (tp = &hnametable[i3 & (HASHNAMESIZE-1)];
+                       for (tp = &hnametable[i2 & (HASHNAMESIZE-1)];

                             tp->nxt; tp = tp->nxt)
                                ;
                             tp->nxt; tp = tp->nxt)
                                ;

-                       tp->addr = i3;
+                       tp->addr = i2;

                        tp->nxt = newhnamemem();
                        tp->name = strdup(nambuf);
                }
                        tp->nxt = newhnamemem();
                        tp->name = strdup(nambuf);
                }


@@ -589,11 +594,9 @@ ataddr_string(u_short atnet, u_char athost)
        tp->addr = (atnet << 8) | athost;
        tp->nxt = newhnamemem();
        if (athost != 255)
        tp->addr = (atnet << 8) | athost;
        tp->nxt = newhnamemem();
        if (athost != 255)

-               (void)snprintf(nambuf, sizeof(nambuf), "%d.%d.%d",
-                   atnet >> 8, atnet & 0xff, athost);
+               (void)snprintf(nambuf, sizeof(nambuf), "%d.%d", atnet, athost);

        else
        else

-               (void)snprintf(nambuf, sizeof(nambuf), "%d.%d", atnet >> 8,
-                   atnet & 0xff);
+               (void)snprintf(nambuf, sizeof(nambuf), "%d", atnet);

        tp->name = strdup(nambuf);
 
        return (tp->name);
        tp->name = strdup(nambuf);
 
        return (tp->name);