Pointers into packet data should usually be pointers to unsigned 1-byte

[tcpdump] / print-radius.c

diff --git a/print-radius.c b/print-radius.c
index d6896e9f0cc80c5ef1ae8b1cf470ac26589ee608..cf5b5983035522d0f7bdaa8d672005a5f5cec3e9 100644 (file)
--- a/print-radius.c
+++ b/print-radius.c
@@ -44,7 +44,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "$Id: print-radius.c,v 1.22 2003-11-26 08:49:15 hannes Exp $";
+    "$Id: print-radius.c,v 1.27 2004-07-21 21:45:47 guy Exp $";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -476,7 +476,7 @@ print_attr_string(register u_char *data, u_int length, u_short attr_code )
         break;
    }
 
-   for (i=0; i < length ; i++, data++)
+   for (i=0; *data && i < length ; i++, data++)
        printf("%c",(*data < 32 || *data > 128) ? '.' : *data );
 
    return;
@@ -503,13 +503,20 @@ print_vendor_attr(register u_char *data, u_int length, u_short attr_code _U_)
     length-=4;
 
     printf("Vendor: %s (%u)",
-           tok2str(oui_values,"Unknown",vendor_id),
+           tok2str(smi_values,"Unknown",vendor_id),
            vendor_id);
 
     while (length >= 2) {
+       if(!TTEST2(*data, 2)) 
+               return;
+
         vendor_type = *(data);
         vendor_length = *(data+1);
+
         data+=2;
+       if(!TTEST2(*data, vendor_length))
+               return;
+
         printf("\n\t    Vendor Attribute: %u, Length: %u, Value: ",
                vendor_type,
                vendor_length);
@@ -803,14 +810,14 @@ radius_attr_print(register const u_char *attr, u_int length)
 
    while (length > 0)
    {
-     if (rad_attr->len == 0)
+     if (rad_attr->len == 0 && rad_attr->type < (TAM_SIZE(attr_type)-1))
      {
        printf("\n\t  %s Attribute (%u), zero-length",
                attr_type[rad_attr->type].name,
                rad_attr->type);
        return;
      }
-     if ( rad_attr->len <= length )
+     if ( rad_attr->len <= length && rad_attr->type < (TAM_SIZE(attr_type)-1))
      {
          printf("\n\t  %s Attribute (%u), length: %u, Value: ",
                 attr_type[rad_attr->type].name,
@@ -833,6 +840,10 @@ radius_attr_print(register const u_char *attr, u_int length)
         printf(" [|radius]");
         return;
      }
+     /* do we also want to see a hex dump ? */
+     if (vflag> 1 && rad_attr->len >= 2)
+         print_unknown_data((u_char *)rad_attr+2,"\n\t    ",(rad_attr->len)-2);
+
      length-=(rad_attr->len);
      rad_attr = (struct radius_attr *)( ((char *)(rad_attr))+rad_attr->len);
    }