Babel: Add a missing length check.

[tcpdump] / print-babel.c

diff --git a/print-babel.c b/print-babel.c
index 6f03e1462660ef39e75e275042c7aabc0046e13b..7dba0765aee84ba36d8b53af4ba2b4e96551d9c0 100644 (file)
--- a/print-babel.c
+++ b/print-babel.c
@@ -359,6 +359,8 @@ babel_print_v2(netdissect_options *ndo,
         goto invalid;
     bodylen = GET_BE_U_2(cp + 2);
     ND_PRINT(" (%u)", bodylen);
+    if (4U + bodylen > length)
+        goto invalid;
 
     /* Process the TLVs in the body */
     i = 0;