Bounds-check the individual components of a SAP reply.

[tcpdump] / print-ospf.c

diff --git a/print-ospf.c b/print-ospf.c
index baf42f609dc5eaa7b858dbba23f8b82e9b1c8ca2..60cb6eb99a1e5663def6c1ff8ebae4e52fcb5fab 100644 (file)
--- a/print-ospf.c
+++ b/print-ospf.c
@@ -23,7 +23,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/tcpdump/print-ospf.c,v 1.54 2004-09-20 14:36:16 hannes Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/tcpdump/print-ospf.c,v 1.56.2.2 2005-05-06 07:57:19 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -51,6 +51,7 @@ static struct tok ospf_option_values[] = {
        { OSPF_OPTION_EA,       "Advertise External" },
        { OSPF_OPTION_DC,       "Demand Circuit" },
        { OSPF_OPTION_O,        "Opaque" },
+       { OSPF_OPTION_DN,       "Up/Down" },
        { 0,                    NULL }
 };
 
@@ -872,15 +873,13 @@ trunc:
 
 void
 ospf_print(register const u_char *bp, register u_int length,
-    register const u_char *bp2)
+    const u_char *bp2 _U_)
 {
        register const struct ospfhdr *op;
-       register const struct ip *ip;
        register const u_char *dataend;
        register const char *cp;
 
        op = (struct ospfhdr *)bp;
-       ip = (struct ip *)bp2;
 
         /* XXX Before we do anything else, strip off the MD5 trailer */
         TCHECK(op->ospf_authtype);
@@ -893,10 +892,9 @@ ospf_print(register const u_char *bp, register u_int length,
        /* value.  If it's not valid, say so and return */
        TCHECK(op->ospf_type);
        cp = tok2str(type2str, "unknown LS-type", op->ospf_type);
-       printf("OSPFv%u, %s (%u), length: %u",
+       printf("OSPFv%u, %s, length: %u",
               op->ospf_version,
               cp,
-              op->ospf_type,
               length);
        if (*cp == 'u')
                return;
@@ -934,8 +932,11 @@ ospf_print(register const u_char *bp, register u_int length,
                        break;
 
                case OSPF_AUTH_SIMPLE:
-                       (void)fn_printn(op->ospf_authdata,
-                           sizeof(op->ospf_authdata), NULL);
+                       if (fn_printn(op->ospf_authdata,
+                           sizeof(op->ospf_authdata), snapend)) {
+                               printf("\"");
+                               goto trunc;
+                       }
                        printf("\"");
                        break;