CVE-2017-13687/CHDLC: Improve bounds and length checks.

[tcpdump] / print-vxlan.c

diff --git a/print-vxlan.c b/print-vxlan.c
index b9c87e2006eb929b6214df08ec81e64dab0d5fcd..0c2a82e2afeda5498b4a876d27f96aa8a5ae4131 100644 (file)
--- a/print-vxlan.c
+++ b/print-vxlan.c
@@ -13,6 +13,10 @@
  * Original code by Francesco Fondelli (francesco dot fondelli, gmail dot com)
  */
 
+/* \summary: Virtual eXtensible Local Area Network (VXLAN) printer */
+
+/* specification: RFC 7348 */
+
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
@@ -22,6 +26,10 @@
 #include "netdissect.h"
 #include "extract.h"
 
+static const char tstr[] = " [|VXLAN]";
+
+#define VXLAN_HDR_LEN 8
+
 /*
  * VXLAN header, RFC7348
  *               Virtual eXtensible Local Area Network (VXLAN): A Framework
@@ -42,10 +50,10 @@ vxlan_print(netdissect_options *ndo, const u_char *bp, u_int len)
     uint8_t flags;
     uint32_t vni;
 
-    if (len < 8) {
-        ND_PRINT((ndo, "[|VXLAN]"));
-        return;
-    }
+    if (len < VXLAN_HDR_LEN)
+        goto trunc;
+
+    ND_TCHECK2(*bp, VXLAN_HDR_LEN);
 
     flags = *bp;
     bp += 4;
@@ -57,5 +65,10 @@ vxlan_print(netdissect_options *ndo, const u_char *bp, u_int len)
     ND_PRINT((ndo, "flags [%s] (0x%02x), ", flags & 0x08 ? "I" : ".", flags));
     ND_PRINT((ndo, "vni %u\n", vni));
 
-    ether_print(ndo, bp, len - 8, len - 8, NULL, NULL);
+    ether_print(ndo, bp, len - VXLAN_HDR_LEN, ndo->ndo_snapend - bp, NULL, NULL);
+
+    return;
+
+trunc:
+    ND_PRINT((ndo, "%s", tstr));
 }