add tracefiles for infinite loop testing

[tcpdump] / print-pppoe.c

diff --git a/print-pppoe.c b/print-pppoe.c
index e69eff750ec2b64d85f259a21319204bd7ad0b65..03886001aa8b3e0a11e374f1071b11b4692ba85a 100644 (file)
--- a/print-pppoe.c
+++ b/print-pppoe.c
@@ -21,6 +21,10 @@
  * Original code by Greg Stark <[email protected]> 
  */
 
+#ifndef lint
+static const char rcsid[] _U_ =
+"@(#) $Header: /tcpdump/master/tcpdump/print-pppoe.c,v 1.24.2.6 2004-08-27 03:56:22 guy Exp $ (LBL)";
+#endif
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
@@ -38,10 +42,6 @@
 #include "ether.h"
 #include "extract.h"                   /* must come after interface.h */
 
-#ifndef lint
-static const char rcsid[] _U_ =
-"@(#) $Header: /tcpdump/master/tcpdump/print-pppoe.c,v 1.26 2003-11-15 01:02:02 guy Exp $ (LBL)";
-#endif
 /* Codes */
 enum {
        PPPOE_PADI = 0x09,
@@ -101,15 +101,17 @@ pppoe_if_print(const struct pcap_pkthdr *h, register const u_char *p)
 u_int
 pppoe_print(register const u_char *bp, u_int length)
 {
-       u_short pppoe_ver, pppoe_type, pppoe_code, pppoe_sessionid, pppoe_length;
+       u_int16_t pppoe_ver, pppoe_type, pppoe_code, pppoe_sessionid;
+       u_int pppoe_length;
        const u_char *pppoe_packet, *pppoe_payload;
 
-       pppoe_packet = bp;
-       if (pppoe_packet > snapend) {
-               printf("[|pppoe]");
-               return (PPPOE_HDRLEN);
+       if (length < PPPOE_HDRLEN) {
+               (void)printf("truncated-pppoe %u", length);
+               return (length);
        }
-
+       length -= PPPOE_HDRLEN;
+       pppoe_packet = bp;
+       TCHECK2(*pppoe_packet, PPPOE_HDRLEN);
        pppoe_ver  = (pppoe_packet[0] & 0xF0) >> 4;
        pppoe_type  = (pppoe_packet[0] & 0x0F);
        pppoe_code = pppoe_packet[1];
@@ -117,11 +119,6 @@ pppoe_print(register const u_char *bp, u_int length)
        pppoe_length    = EXTRACT_16BITS(pppoe_packet + 4);
        pppoe_payload = pppoe_packet + PPPOE_HDRLEN;
 
-       if (snapend < pppoe_payload) {
-               printf(" truncated PPPoE");
-               return (PPPOE_HDRLEN);
-       }
-
        if (pppoe_ver != 1) {
                printf(" [ver %d]",pppoe_ver);
        }
@@ -131,25 +128,29 @@ pppoe_print(register const u_char *bp, u_int length)
 
        printf("PPPoE %s", tok2str(pppoecode2str, "PAD-%x", pppoe_code));
        if (pppoe_code == PPPOE_PADI && pppoe_length > 1484 - PPPOE_HDRLEN) {
-               printf(" [len %d!]",pppoe_length);
+               printf(" [len %u!]",pppoe_length);
+       }
+       if (pppoe_length > length) {
+               printf(" [len %u > %u!]", pppoe_length, length);
+               pppoe_length = length;
        }
        if (pppoe_sessionid) {
                printf(" [ses 0x%x]", pppoe_sessionid);
        }
 
-       if (pppoe_payload + pppoe_length < snapend && snapend-pppoe_payload+14 > 64) {
+       if (pppoe_length < length && length + ETHER_HDRLEN > 60) {
                /* (small packets are probably just padded up to the ethernet
-                  minimum of 64 bytes) */
-               printf(" [length %d (%d extra bytes)]",
-                   pppoe_length, snapend - pppoe_payload - pppoe_length);
+                  minimum of 60 bytes of data + 4 bytes of CRC) */
+               printf(" [length %u (%u extra bytes)]",
+                   pppoe_length, length - pppoe_length);
 #if RESPECT_PAYLOAD_LENGTH
-               snapend = pppoe_payload+pppoe_length;
+               if (snaplend > pppoe_payload+pppoe_length)
+                       snapend = pppoe_payload+pppoe_length;
 #else
                /* Actual PPPoE implementations appear to ignore the payload
                   length and use the full ethernet frame anyways */
-               pppoe_length = snapend-pppoe_payload;
+               pppoe_length = length;
 #endif
-               
        }
 
        if (pppoe_code) {
@@ -159,11 +160,11 @@ pppoe_print(register const u_char *bp, u_int length)
 
                /*
                 * loop invariant:
-                * p points to next tag,
+                * p points to current tag,
                 * tag_type is previous tag or 0xffff for first iteration
                 */
-               while (tag_type && p + 4 < pppoe_payload + length &&
-                   p + 4 < snapend) {
+               while (tag_type && p < pppoe_payload + pppoe_length) {
+                       TCHECK2(*p, 4);
                        tag_type = EXTRACT_16BITS(p);
                        tag_len = EXTRACT_16BITS(p + 2);
                        p += 4;
@@ -176,6 +177,7 @@ pppoe_print(register const u_char *bp, u_int length)
                                unsigned tag_str_len = 0;
 
                                /* TODO print UTF-8 decoded text */
+                               TCHECK2(*p, tag_len);
                                for (v = p; v < p + tag_len && tag_str_len < MAXTAGPRINT-1; v++)
                                        if (*v >= 32 && *v < 127) {
                                                tag_str[tag_str_len++] = *v;
@@ -215,4 +217,8 @@ pppoe_print(register const u_char *bp, u_int length)
                printf(" ");
                return (PPPOE_HDRLEN + ppp_print(pppoe_payload, pppoe_length));
        }
+
+trunc:
+       printf("[|pppoe]");
+       return (PPPOE_HDRLEN);
 }