Bounds-check the individual components of a SAP reply.

[tcpdump] / print-ntp.c

diff --git a/print-ntp.c b/print-ntp.c
index fd5143bc19de236aa5835c10110e537ffe2e7b88..b408e0877e460874f330e1d34752e212fd939eee 100644 (file)
--- a/print-ntp.c
+++ b/print-ntp.c
@@ -25,7 +25,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/tcpdump/print-ntp.c,v 1.40 2004-01-28 14:34:50 hannes Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/tcpdump/print-ntp.c,v 1.41.2.1 2005-05-06 07:57:18 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -82,9 +82,6 @@ ntp_print(register const u_char *cp, u_int length)
        int mode, version, leapind;
 
        bp = (struct ntpdata *)cp;
-       /* Note funny sized packets */
-       if (length != sizeof(struct ntpdata))
-               (void)printf(" [len=%d]", length);
 
        TCHECK(bp->status);
 
@@ -136,7 +133,8 @@ ntp_print(register const u_char *cp, u_int length)
                break;
 
        case PRIM_REF:
-               fn_printn((u_char *)&(bp->refid), 4, NULL);
+               if (fn_printn((u_char *)&(bp->refid), 4, snapend))
+                       goto trunc;
                break;
 
        case INFO_QUERY: