Handle very large -f files by rejecting them.

[tcpdump] / print-lspping.c

diff --git a/print-lspping.c b/print-lspping.c
index 7e629dbcd60226c51dadf74e057f8b1993c99450..274cc68b7630978415b7136c120c2ef48754d290 100644 (file)
--- a/print-lspping.c
+++ b/print-lspping.c
@@ -10,7 +10,7 @@
  * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  * FOR A PARTICULAR PURPOSE.
  *
- * Original code by Hannes Gredler (hannes@juniper.net)
+ * Original code by Hannes Gredler (hannes@gredler.at)
  */
 
 /* \summary: MPLS LSP PING printer */
@@ -104,6 +104,7 @@ static const struct tok lspping_return_code_values[] = {
     { 11, "No label entry at stack-depth"},
     { 12, "Protocol not associated with interface at FEC stack depth"},
     { 13, "Premature termination of ping due to label stack shrinking to a single label"},
+    { 0,  NULL},
 };
 
 
@@ -637,10 +638,11 @@ lspping_print(netdissect_options *ndo,
         switch(lspping_tlv_type) {
         case LSPPING_TLV_TARGET_FEC_STACK:
             while (tlv_tlen != 0) {
-                /* Does the subTLV go past the end of the TLV? */
+                /* Does the subTLV header go past the end of the TLV? */
                 if (tlv_tlen < sizeof(struct lspping_tlv_header)) {
-                    subtlv_hexdump = TRUE;
-                    goto subtlv_too_short;
+                    ND_PRINT((ndo, "\n\t      TLV is too short"));
+                    tlv_hexdump = TRUE;
+                    goto tlv_tooshort;
                 }
                 /* did we capture enough for fully decoding the subtlv header ? */
                 ND_TCHECK2(*tlv_tptr, sizeof(struct lspping_tlv_header));
@@ -653,8 +655,9 @@ lspping_print(netdissect_options *ndo,
 
                 /* Does the subTLV go past the end of the TLV? */
                 if (tlv_tlen < lspping_subtlv_len+sizeof(struct lspping_tlv_header)) {
-                    subtlv_hexdump = TRUE;
-                    goto subtlv_too_short;
+                    ND_PRINT((ndo, "\n\t      TLV is too short"));
+                    tlv_hexdump = TRUE;
+                    goto tlv_tooshort;
                 }
 
                 /* Did we capture enough for fully decoding the subTLV? */
@@ -856,7 +859,6 @@ lspping_print(netdissect_options *ndo,
                     break;
                 }
                 /* do we want to see an additionally subtlv hexdump ? */
-            subtlv_too_short:
                 if (ndo->ndo_vflag > 1 || subtlv_hexdump==TRUE)
                     print_unknown_data(ndo, tlv_tptr+sizeof(struct lspping_tlv_header), \
                                        "\n\t      ",
@@ -880,7 +882,8 @@ lspping_print(netdissect_options *ndo,
             /* Does the header go past the end of the TLV? */
             if (tlv_tlen < sizeof(struct lspping_tlv_downstream_map_t)) {
                 ND_PRINT((ndo, "\n\t      TLV is too short"));
-                goto map_tlv_tooshort;
+                tlv_hexdump = TRUE;
+                goto tlv_tooshort;
             }
             /* Did we capture enough to get the address family? */
             ND_TCHECK2(*tlv_tptr, sizeof(struct lspping_tlv_downstream_map_t));
@@ -905,7 +908,8 @@ lspping_print(netdissect_options *ndo,
                 /* Does the data go past the end of the TLV? */
                 if (tlv_tlen < sizeof(struct lspping_tlv_downstream_map_ipv4_t)) {
                     ND_PRINT((ndo, "\n\t      TLV is too short"));
-                    goto map_tlv_tooshort;
+                    tlv_hexdump = TRUE;
+                    goto tlv_tooshort;
                 }
                 /* Did we capture enough for this part of the TLV? */
                 ND_TCHECK2(*tlv_tptr, sizeof(struct lspping_tlv_downstream_map_ipv4_t));
@@ -923,7 +927,8 @@ lspping_print(netdissect_options *ndo,
                 /* Does the data go past the end of the TLV? */
                 if (tlv_tlen < sizeof(struct lspping_tlv_downstream_map_ipv4_unmb_t)) {
                     ND_PRINT((ndo, "\n\t      TLV is too short"));
-                    goto map_tlv_tooshort;
+                    tlv_hexdump = TRUE;
+                    goto tlv_tooshort;
                 }
                 /* Did we capture enough for this part of the TLV? */
                 ND_TCHECK2(*tlv_tptr, sizeof(struct lspping_tlv_downstream_map_ipv4_unmb_t));
@@ -941,7 +946,8 @@ lspping_print(netdissect_options *ndo,
                 /* Does the data go past the end of the TLV? */
                 if (tlv_tlen < sizeof(struct lspping_tlv_downstream_map_ipv6_t)) {
                     ND_PRINT((ndo, "\n\t      TLV is too short"));
-                    goto map_tlv_tooshort;
+                    tlv_hexdump = TRUE;
+                    goto tlv_tooshort;
                 }
                 /* Did we capture enough for this part of the TLV? */
                 ND_TCHECK2(*tlv_tptr, sizeof(struct lspping_tlv_downstream_map_ipv6_t));
@@ -959,7 +965,8 @@ lspping_print(netdissect_options *ndo,
                 /* Does the data go past the end of the TLV? */
                 if (tlv_tlen < sizeof(struct lspping_tlv_downstream_map_ipv6_unmb_t)) {
                     ND_PRINT((ndo, "\n\t      TLV is too short"));
-                    goto map_tlv_tooshort;
+                    tlv_hexdump = TRUE;
+                    goto tlv_tooshort;
                 }
                 /* Did we capture enough for this part of the TLV? */
                 ND_TCHECK2(*tlv_tptr, sizeof(struct lspping_tlv_downstream_map_ipv6_unmb_t));
@@ -982,7 +989,8 @@ lspping_print(netdissect_options *ndo,
             /* Does the data go past the end of the TLV? */
             if (tlv_tlen < sizeof(struct lspping_tlv_downstream_map_info_t)) {
                 ND_PRINT((ndo, "\n\t      TLV is too short"));
-                goto map_tlv_tooshort;
+                tlv_hexdump = TRUE;
+                goto tlv_tooshort;
             }
             /* Did we capture enough for this part of the TLV? */
             ND_TCHECK2(*tlv_tptr, sizeof(struct lspping_tlv_downstream_map_info_t));
@@ -997,7 +1005,6 @@ lspping_print(netdissect_options *ndo,
 
             /* FIXME print downstream labels */
 
-        map_tlv_tooshort:
             tlv_hexdump=TRUE; /* dump the TLV until code complete */
 
             break;
@@ -1005,6 +1012,8 @@ lspping_print(netdissect_options *ndo,
         case LSPPING_TLV_BFD_DISCRIMINATOR:
             if (tlv_tlen < LSPPING_TLV_BFD_DISCRIMINATOR_LEN) {
                 ND_PRINT((ndo, "\n\t      TLV is too short"));
+                tlv_hexdump = TRUE;
+                goto tlv_tooshort;
             } else {
                 ND_TCHECK2(*tptr, LSPPING_TLV_BFD_DISCRIMINATOR_LEN);
                 ND_PRINT((ndo, "\n\t    BFD Discriminator 0x%08x", EXTRACT_32BITS(tptr)));
@@ -1017,6 +1026,8 @@ lspping_print(netdissect_options *ndo,
 
             if (tlv_tlen < LSPPING_TLV_VENDOR_ENTERPRISE_LEN) {
                 ND_PRINT((ndo, "\n\t      TLV is too short"));
+                tlv_hexdump = TRUE;
+                goto tlv_tooshort;
             } else {
                 ND_TCHECK2(*tptr, LSPPING_TLV_VENDOR_ENTERPRISE_LEN);
                 vendor_id = EXTRACT_32BITS(tlv_tptr);
@@ -1041,6 +1052,7 @@ lspping_print(netdissect_options *ndo,
             break;
         }
         /* do we want to see an additionally tlv hexdump ? */
+    tlv_tooshort:
         if (ndo->ndo_vflag > 1 || tlv_hexdump==TRUE)
             print_unknown_data(ndo, tptr+sizeof(struct lspping_tlv_header), "\n\t    ",
                                lspping_tlv_len);