CVE-2017-13045/VQP: add some bounds checks

[tcpdump] / print-ospf.c

diff --git a/print-ospf.c b/print-ospf.c
index 0628832dfdc1ef27437d899250d3d95b14b7f5d6..db4231ba0f85eec030c4fca34682cf4719c396dd 100644 (file)
--- a/print-ospf.c
+++ b/print-ospf.c
@@ -21,6 +21,8 @@
  * OSPF support contributed by Jeffrey Honig ([email protected])
  */
 
+/* \summary: Open Shortest Path First (OSPF) printer */
+
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
@@ -575,7 +577,7 @@ static const struct tok ospf_topology_values[] = {
 /*
  * Print all the per-topology metrics.
  */
-static void
+static int
 ospf_print_tos_metrics(netdissect_options *ndo,
                        const union un_tos *tos)
 {
@@ -588,7 +590,8 @@ ospf_print_tos_metrics(netdissect_options *ndo,
     /*
      * All but the first metric contain a valid topology id.
      */
-    while (toscount) {
+    while (toscount > 0) {
+        ND_TCHECK(*tos);
         ND_PRINT((ndo, "\n\t\ttopology %s (%u), metric %u",
                tok2str(ospf_topology_values, "Unknown",
                        metric_count ? tos->metrics.tos_type : 0),
@@ -598,6 +601,9 @@ ospf_print_tos_metrics(netdissect_options *ndo,
         tos++;
         toscount--;
     }
+    return 0;
+trunc:
+    return 1;
 }
 
 /*
@@ -671,7 +677,8 @@ ospf_print_lsa(netdissect_options *ndo,
                                return (ls_end);
                        }
 
-                       ospf_print_tos_metrics(ndo, &rlp->un_tos);
+                       if (ospf_print_tos_metrics(ndo, &rlp->un_tos))
+                               goto trunc;
 
                        rlp = (const struct rlalink *)((const u_char *)(rlp + 1) +
                            ((rlp->un_tos.link.link_tos_count) * sizeof(union un_tos)));
@@ -989,6 +996,7 @@ ospf_decode_v2(netdissect_options *ndo,
                break;
 
        case OSPF_TYPE_HELLO:
+               ND_TCHECK(op->ospf_hello.hello_options);
                ND_PRINT((ndo, "\n\tOptions [%s]",
                          bittok2str(ospf_option_values,"none",op->ospf_hello.hello_options)));