CVE-2017-13045/VQP: add some bounds checks

[tcpdump] / print-ospf.c

diff --git a/print-ospf.c b/print-ospf.c
index 0628832dfdc1ef27437d899250d3d95b14b7f5d6..db4231ba0f85eec030c4fca34682cf4719c396dd 100644 (file)
--- a/print-ospf.c
+++ b/print-ospf.c
@@ -21,6 +21,8 @@
  * OSPF support contributed by Jeffrey Honig ([email protected])
  */
 
  * OSPF support contributed by Jeffrey Honig ([email protected])
  */
 

+/* \summary: Open Shortest Path First (OSPF) printer */
+

 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif


@@ -575,7 +577,7 @@ static const struct tok ospf_topology_values[] = {
 /*
  * Print all the per-topology metrics.
  */
 /*
  * Print all the per-topology metrics.
  */

-static void
+static int

 ospf_print_tos_metrics(netdissect_options *ndo,
                        const union un_tos *tos)
 {
 ospf_print_tos_metrics(netdissect_options *ndo,
                        const union un_tos *tos)
 {


@@ -588,7 +590,8 @@ ospf_print_tos_metrics(netdissect_options *ndo,
     /*
      * All but the first metric contain a valid topology id.
      */
     /*
      * All but the first metric contain a valid topology id.
      */

-    while (toscount) {
+    while (toscount > 0) {
+        ND_TCHECK(*tos);

         ND_PRINT((ndo, "\n\t\ttopology %s (%u), metric %u",
                tok2str(ospf_topology_values, "Unknown",
                        metric_count ? tos->metrics.tos_type : 0),
         ND_PRINT((ndo, "\n\t\ttopology %s (%u), metric %u",
                tok2str(ospf_topology_values, "Unknown",
                        metric_count ? tos->metrics.tos_type : 0),


@@ -598,6 +601,9 @@ ospf_print_tos_metrics(netdissect_options *ndo,
         tos++;
         toscount--;
     }
         tos++;
         toscount--;
     }

+    return 0;
+trunc:
+    return 1;

 }
 
 /*
 }
 
 /*


@@ -671,7 +677,8 @@ ospf_print_lsa(netdissect_options *ndo,
                                return (ls_end);
                        }
 
                                return (ls_end);
                        }
 

-                       ospf_print_tos_metrics(ndo, &rlp->un_tos);
+                       if (ospf_print_tos_metrics(ndo, &rlp->un_tos))
+                               goto trunc;

 
                        rlp = (const struct rlalink *)((const u_char *)(rlp + 1) +
                            ((rlp->un_tos.link.link_tos_count) * sizeof(union un_tos)));
 
                        rlp = (const struct rlalink *)((const u_char *)(rlp + 1) +
                            ((rlp->un_tos.link.link_tos_count) * sizeof(union un_tos)));


@@ -989,6 +996,7 @@ ospf_decode_v2(netdissect_options *ndo,
                break;
 
        case OSPF_TYPE_HELLO:
                break;
 
        case OSPF_TYPE_HELLO:

+               ND_TCHECK(op->ospf_hello.hello_options);

                ND_PRINT((ndo, "\n\tOptions [%s]",
                          bittok2str(ospf_option_values,"none",op->ospf_hello.hello_options)));
 
                ND_PRINT((ndo, "\n\tOptions [%s]",
                          bittok2str(ospf_option_values,"none",op->ospf_hello.hello_options)));