Bounds-check the individual components of a SAP reply.

[tcpdump] / print-ldp.c

diff --git a/print-ldp.c b/print-ldp.c
index 8ef7764cfbc86648ad864bd97730cf13d395bf9f..560fdb6ae4c226d5a5acb7c7e868b448ad3875e4 100644 (file)
--- a/print-ldp.c
+++ b/print-ldp.c
@@ -16,7 +16,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/tcpdump/print-ldp.c,v 1.8.2.1 2005-04-19 19:42:08 hannes Exp $";
+    "@(#) $Header: /tcpdump/master/tcpdump/print-ldp.c,v 1.8.2.4 2005-05-03 08:23:07 hannes Exp $";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -352,14 +352,23 @@ ldp_tlv_print(register const u_char *tptr) {
        case LDP_FEC_HOSTADDRESS:
            break;
        case LDP_FEC_MARTINI_VC:
+            if (!TTEST2(*tptr, 11))
+                goto trunc;
             vc_info_len = *(tptr+2);
+
            printf(": %s, %scontrol word, group-ID %u, VC-ID %u, VC-info-length: %u",
                   tok2str(l2vpn_encaps_values, "Unknown", EXTRACT_16BITS(tptr)&0x7fff),
                   EXTRACT_16BITS(tptr)&0x8000 ? "" : "no ",
                    EXTRACT_32BITS(tptr+3),
                   EXTRACT_32BITS(tptr+7),
                    vc_info_len);
+
+            if (vc_info_len == 0) /* infinite loop protection */
+                break;
+
             tptr+=11;
+            if (!TTEST2(*tptr, vc_info_len))
+                goto trunc;
 
             while (vc_info_len > 2) {
                 vc_info_tlv_type = *tptr;
@@ -384,9 +393,12 @@ ldp_tlv_print(register const u_char *tptr) {
                     break;
 
                 case LDP_FEC_MARTINI_IFPARM_VCCV:
-                    printf("\n\t\t  Control Channel Flags [%s]\n\t\t  CV Types [%s]",
-                           bittok2str(ldp_fec_martini_ifparm_vccv_cc_values,"none",*tptr+2),
-                           bittok2str(ldp_fec_martini_ifparm_vccv_cc_values,"none",*tptr+3));
+                    printf("\n\t\t  Control Channels (0x%02x) = [%s]",
+                           *(tptr+2),
+                           bittok2str(ldp_fec_martini_ifparm_vccv_cc_values,"none",*(tptr+2)));
+                    printf("\n\t\t  CV Types (0x%02x) = [%s]",
+                           *(tptr+3),
+                           bittok2str(ldp_fec_martini_ifparm_vccv_cv_values,"none",*(tptr+3)));
                     break;
 
                 default:
@@ -460,6 +472,10 @@ ldp_tlv_print(register const u_char *tptr) {
         break;
     }
     return(tlv_len+4); /* Type & Length fields not included */
+ 
+trunc:
+    printf("\n\t\t packet exceeded snapshot");
+    return 0;
 }
 
 void
@@ -537,6 +553,9 @@ ldp_msg_print(register const u_char *pptr) {
                EXTRACT_32BITS(&ldp_msg_header->id),
                LDP_MASK_U_BIT(EXTRACT_16BITS(&ldp_msg_header->type)) ? "continue processing" : "ignore");
 
+        if (msg_len == 0) /* infinite loop protection */
+            return 0;
+
         msg_tptr=tptr+sizeof(struct ldp_msg_header);
         msg_tlen=msg_len-sizeof(struct ldp_msg_header)+4; /* Type & Length fields not included */