+ subobj_len);
+
+ /* In addition to what is explained above, the same spec does not
+ * explicitly say that the same Length field includes the 4-octet
+ * sub-object header, but as long as this while loop implements it
+ * as it does include, let's keep the check below consistent with
+ * the rest of the code.
+ *
+ * XXX - RFC 3476 Section 3.1 says "The contents of these
+ * sub-objects are described in [8]", where [8] is
+ * UNI 1.0 Signaling Specification, The Optical
+ * Internetworking Forum. The URL they give for that
+ * document is
+ *
+ * http://www.oiforum.com/public/UNI_1.0_ia.html
+ *
+ * but that doesn't work; the new URL appears to be
+ *
+ * https://web.archive.org/web/20160401194747/http://www.oiforum.com/public/documents/OIF-UNI-01.0.pdf
+ *
+ * and *that* document, in section 12.5.2.3
+ * "GENERALIZED_UNI Object (Class-Num=11bbbbbb (TBA))",
+ * says nothing about the length field in general, but
+ * some of the examples it gives in subsections have
+ * length field values that clearly includes the length
+ * of the sub-object header as well as the length of the
+ * value.
+ */
+ if(subobj_len < 4 || subobj_len > total_subobj_len ||
+ obj_tlen < subobj_len)
+ goto invalid;
projects / tcpdump / blobdiff