CVE-2017-5485/add the test case

[tcpdump] / print-aodv.c

diff --git a/print-aodv.c b/print-aodv.c
index da5b169956af09e54930e3aaad10ef444a014f2d..6cd0c9ea1b6de17a55a17ec2e6f68a73e15331c8 100644 (file)
--- a/print-aodv.c
+++ b/print-aodv.c
@@ -30,19 +30,17 @@
  * POSSIBILITY OF SUCH DAMAGE.
  */
 
  * POSSIBILITY OF SUCH DAMAGE.
  */
 

-#define NETDISSECT_REWORKED
+/* \summary: Ad hoc On-Demand Distance Vector (AODV) Routing printer */
+

 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
 

-#include <tcpdump-stdinc.h>
-
-/* for offsetof */
-#include <stddef.h>
+#include <netdissect-stdinc.h>

 
 

-#include "interface.h"
+#include "netdissect.h"

 #include "addrtoname.h"
 #include "addrtoname.h"

-#include "extract.h"                   /* must come after interface.h */
+#include "extract.h"

 
 
 struct aodv_rreq {
 
 
 struct aodv_rreq {


@@ -56,7 +54,6 @@ struct aodv_rreq {
        uint32_t        rreq_oa;        /* originator IPv4 address */
        uint32_t        rreq_os;        /* originator sequence number */
 };
        uint32_t        rreq_oa;        /* originator IPv4 address */
        uint32_t        rreq_os;        /* originator sequence number */
 };

-#ifdef INET6

 struct aodv_rreq6 {
        uint8_t         rreq_type;      /* AODV message type (1) */
        uint8_t         rreq_flags;     /* various flags */
 struct aodv_rreq6 {
        uint8_t         rreq_type;      /* AODV message type (1) */
        uint8_t         rreq_flags;     /* various flags */


@@ -79,7 +76,6 @@ struct aodv_rreq6_draft_01 {
        struct in6_addr rreq_da;        /* destination IPv6 address */
        struct in6_addr rreq_oa;        /* originator IPv6 address */
 };
        struct in6_addr rreq_da;        /* destination IPv6 address */
        struct in6_addr rreq_oa;        /* originator IPv6 address */
 };

-#endif

 
 #define        RREQ_JOIN       0x80            /* join (reserved for multicast */
 #define        RREQ_REPAIR     0x40            /* repair (reserved for multicast */
 
 #define        RREQ_JOIN       0x80            /* join (reserved for multicast */
 #define        RREQ_REPAIR     0x40            /* repair (reserved for multicast */


@@ -98,7 +94,6 @@ struct aodv_rrep {
        uint32_t        rrep_oa;        /* originator IPv4 address */
        uint32_t        rrep_life;      /* lifetime of this route */
 };
        uint32_t        rrep_oa;        /* originator IPv4 address */
        uint32_t        rrep_life;      /* lifetime of this route */
 };

-#ifdef INET6

 struct aodv_rrep6 {
        uint8_t         rrep_type;      /* AODV message type (2) */
        uint8_t         rrep_flags;     /* various flags */
 struct aodv_rrep6 {
        uint8_t         rrep_type;      /* AODV message type (2) */
        uint8_t         rrep_flags;     /* various flags */


@@ -119,7 +114,6 @@ struct aodv_rrep6_draft_01 {
        struct in6_addr rrep_oa;        /* originator IPv6 address */
        uint32_t        rrep_life;      /* lifetime of this route */
 };
        struct in6_addr rrep_oa;        /* originator IPv6 address */
        uint32_t        rrep_life;      /* lifetime of this route */
 };

-#endif

 
 #define        RREP_REPAIR             0x80    /* repair (reserved for multicast */
 #define        RREP_ACK                0x40    /* acknowledgement required */
 
 #define        RREP_REPAIR             0x80    /* repair (reserved for multicast */
 #define        RREP_ACK                0x40    /* acknowledgement required */


@@ -130,7 +124,6 @@ struct rerr_unreach {
        uint32_t        u_da;   /* IPv4 address */
        uint32_t        u_ds;   /* sequence number */
 };
        uint32_t        u_da;   /* IPv4 address */
        uint32_t        u_ds;   /* sequence number */
 };

-#ifdef INET6

 struct rerr_unreach6 {
        struct in6_addr u_da;   /* IPv6 address */
        uint32_t        u_ds;   /* sequence number */
 struct rerr_unreach6 {
        struct in6_addr u_da;   /* IPv6 address */
        uint32_t        u_ds;   /* sequence number */


@@ -139,20 +132,12 @@ struct rerr_unreach6_draft_01 {
        struct in6_addr u_da;   /* IPv6 address */
        uint32_t        u_ds;   /* sequence number */
 };
        struct in6_addr u_da;   /* IPv6 address */
        uint32_t        u_ds;   /* sequence number */
 };

-#endif

 
 struct aodv_rerr {
        uint8_t         rerr_type;      /* AODV message type (3 or 18) */
        uint8_t         rerr_flags;     /* various flags */
        uint8_t         rerr_zero0;     /* reserved, set to zero */
        uint8_t         rerr_dc;        /* destination count */
 
 struct aodv_rerr {
        uint8_t         rerr_type;      /* AODV message type (3 or 18) */
        uint8_t         rerr_flags;     /* various flags */
        uint8_t         rerr_zero0;     /* reserved, set to zero */
        uint8_t         rerr_dc;        /* destination count */

-       union {
-               struct  rerr_unreach dest[1];
-#ifdef INET6
-               struct  rerr_unreach6 dest6[1];
-               struct  rerr_unreach6_draft_01 dest6_draft_01[1];
-#endif
-       } r;

 };
 
 #define RERR_NODELETE          0x80    /* don't delete the link */
 };
 
 #define RERR_NODELETE          0x80    /* don't delete the link */


@@ -191,22 +176,14 @@ static void
 aodv_extension(netdissect_options *ndo,
                const struct aodv_ext *ep, u_int length)
 {
 aodv_extension(netdissect_options *ndo,
                const struct aodv_ext *ep, u_int length)
 {

-       u_int i;

        const struct aodv_hello *ah;
 
        switch (ep->type) {
        case AODV_EXT_HELLO:
        const struct aodv_hello *ah;
 
        switch (ep->type) {
        case AODV_EXT_HELLO:

-               if (ndo->ndo_snapend < (u_char *) ep) {
-                       ND_PRINT((ndo, " [|hello]"));
-                       return;
-               }
-               i = min(length, (u_int)(ndo->ndo_snapend - (u_char *)ep));
-               if (i < sizeof(struct aodv_hello)) {
-                       ND_PRINT((ndo, " [|hello]"));
-                       return;
-               }
-               i -= sizeof(struct aodv_hello);
-               ah = (void *)ep;
+               ah = (const struct aodv_hello *)(const void *)ep;
+               ND_TCHECK(*ah);
+               if (length < sizeof(struct aodv_hello))
+                       goto trunc;

                ND_PRINT((ndo, "\n\text HELLO %ld ms",
                    (unsigned long)EXTRACT_32BITS(&ah->interval)));
                break;
                ND_PRINT((ndo, "\n\text HELLO %ld ms",
                    (unsigned long)EXTRACT_32BITS(&ah->interval)));
                break;


@@ -215,24 +192,21 @@ aodv_extension(netdissect_options *ndo,
                ND_PRINT((ndo, "\n\text %u %u", ep->type, ep->length));
                break;
        }
                ND_PRINT((ndo, "\n\text %u %u", ep->type, ep->length));
                break;
        }

+       return;
+
+trunc:
+       ND_PRINT((ndo, " [|hello]"));

 }
 
 static void
 }
 
 static void

-aodv_rreq(netdissect_options *ndo,
-          const struct aodv_rreq *ap, const u_char *dat, u_int length)
+aodv_rreq(netdissect_options *ndo, const u_char *dat, u_int length)

 {
        u_int i;
 {
        u_int i;

+       const struct aodv_rreq *ap = (const struct aodv_rreq *)dat;

 
 

-       if (ndo->ndo_snapend < dat) {
-               ND_PRINT((ndo, " [|aodv]"));
-               return;
-       }
-       i = min(length, (u_int)(ndo->ndo_snapend - dat));
-       if (i < sizeof(*ap)) {
-               ND_PRINT((ndo, " [|rreq]"));
-               return;
-       }
-       i -= sizeof(*ap);
+       ND_TCHECK(*ap);
+       if (length < sizeof(*ap))
+               goto trunc;

        ND_PRINT((ndo, " rreq %u %s%s%s%s%shops %u id 0x%08lx\n"
            "\tdst %s seq %lu src %s seq %lu", length,
            ap->rreq_type & RREQ_JOIN ? "[J]" : "",
        ND_PRINT((ndo, " rreq %u %s%s%s%s%shops %u id 0x%08lx\n"
            "\tdst %s seq %lu src %s seq %lu", length,
            ap->rreq_type & RREQ_JOIN ? "[J]" : "",


@@ -246,26 +220,24 @@ aodv_rreq(netdissect_options *ndo,
            (unsigned long)EXTRACT_32BITS(&ap->rreq_ds),
            ipaddr_string(ndo, &ap->rreq_oa),
            (unsigned long)EXTRACT_32BITS(&ap->rreq_os)));
            (unsigned long)EXTRACT_32BITS(&ap->rreq_ds),
            ipaddr_string(ndo, &ap->rreq_oa),
            (unsigned long)EXTRACT_32BITS(&ap->rreq_os)));

+       i = length - sizeof(*ap);

        if (i >= sizeof(struct aodv_ext))
        if (i >= sizeof(struct aodv_ext))

-               aodv_extension(ndo, (void *)(ap + 1), i);
+               aodv_extension(ndo, (const struct aodv_ext *)(dat + sizeof(*ap)), i);
+       return;
+
+trunc:
+       ND_PRINT((ndo, " [|rreq"));

 }
 
 static void
 }
 
 static void

-aodv_rrep(netdissect_options *ndo,
-          const struct aodv_rrep *ap, const u_char *dat, u_int length)
+aodv_rrep(netdissect_options *ndo, const u_char *dat, u_int length)

 {
        u_int i;
 {
        u_int i;

+       const struct aodv_rrep *ap = (const struct aodv_rrep *)dat;

 
 

-       if (ndo->ndo_snapend < dat) {
-               ND_PRINT((ndo, " [|aodv]"));
-               return;
-       }
-       i = min(length, (u_int)(ndo->ndo_snapend - dat));
-       if (i < sizeof(*ap)) {
-               ND_PRINT((ndo, " [|rrep]"));
-               return;
-       }
-       i -= sizeof(*ap);
+       ND_TCHECK(*ap);
+       if (length < sizeof(*ap))
+               goto trunc;

        ND_PRINT((ndo, " rrep %u %s%sprefix %u hops %u\n"
            "\tdst %s dseq %lu src %s %lu ms", length,
            ap->rrep_type & RREP_REPAIR ? "[R]" : "",
        ND_PRINT((ndo, " rrep %u %s%sprefix %u hops %u\n"
            "\tdst %s dseq %lu src %s %lu ms", length,
            ap->rrep_type & RREP_REPAIR ? "[R]" : "",


@@ -276,65 +248,54 @@ aodv_rrep(netdissect_options *ndo,
            (unsigned long)EXTRACT_32BITS(&ap->rrep_ds),
            ipaddr_string(ndo, &ap->rrep_oa),
            (unsigned long)EXTRACT_32BITS(&ap->rrep_life)));
            (unsigned long)EXTRACT_32BITS(&ap->rrep_ds),
            ipaddr_string(ndo, &ap->rrep_oa),
            (unsigned long)EXTRACT_32BITS(&ap->rrep_life)));

+       i = length - sizeof(*ap);

        if (i >= sizeof(struct aodv_ext))
        if (i >= sizeof(struct aodv_ext))

-               aodv_extension(ndo, (void *)(ap + 1), i);
+               aodv_extension(ndo, (const struct aodv_ext *)(dat + sizeof(*ap)), i);
+       return;
+
+trunc:
+       ND_PRINT((ndo, " [|rreq"));

 }
 
 static void
 }
 
 static void

-aodv_rerr(netdissect_options *ndo,
-          const struct aodv_rerr *ap, const u_char *dat, u_int length)
+aodv_rerr(netdissect_options *ndo, const u_char *dat, u_int length)

 {
 {

-       u_int i;
-       const struct rerr_unreach *dp = NULL;
-       int n, trunc;
+       u_int i, dc;
+       const struct aodv_rerr *ap = (const struct aodv_rerr *)dat;
+       const struct rerr_unreach *dp;

 
 

-       if (ndo->ndo_snapend < dat) {
-               ND_PRINT((ndo, " [|aodv]"));
-               return;
-       }
-       i = min(length, (u_int)(ndo->ndo_snapend - dat));
-       if (i < offsetof(struct aodv_rerr, r)) {
-               ND_PRINT((ndo, " [|rerr]"));
-               return;
-       }
-       i -= offsetof(struct aodv_rerr, r);
-       dp = &ap->r.dest[0];
-       n = ap->rerr_dc * sizeof(ap->r.dest[0]);
+       ND_TCHECK(*ap);
+       if (length < sizeof(*ap))
+               goto trunc;

        ND_PRINT((ndo, " rerr %s [items %u] [%u]:",
            ap->rerr_flags & RERR_NODELETE ? "[D]" : "",
            ap->rerr_dc, length));
        ND_PRINT((ndo, " rerr %s [items %u] [%u]:",
            ap->rerr_flags & RERR_NODELETE ? "[D]" : "",
            ap->rerr_dc, length));

-       trunc = n - (i/sizeof(ap->r.dest[0]));
-       for (; i >= sizeof(ap->r.dest[0]);
-           ++dp, i -= sizeof(ap->r.dest[0])) {
+       dp = (const struct rerr_unreach *)(dat + sizeof(*ap));
+       i = length - sizeof(*ap);
+       for (dc = ap->rerr_dc; dc != 0; dc--) {
+               ND_TCHECK(*dp);
+               if (i < sizeof(*dp))
+                       goto trunc;

                ND_PRINT((ndo, " {%s}(%ld)", ipaddr_string(ndo, &dp->u_da),
                    (unsigned long)EXTRACT_32BITS(&dp->u_ds)));
                ND_PRINT((ndo, " {%s}(%ld)", ipaddr_string(ndo, &dp->u_da),
                    (unsigned long)EXTRACT_32BITS(&dp->u_ds)));

+               dp++;
+               i -= sizeof(*dp);

        }
        }

-       if (trunc)
-               ND_PRINT((ndo, "[|rerr]"));
+       return;
+
+trunc:
+       ND_PRINT((ndo, "[|rerr]"));

 }
 
 static void
 }
 
 static void

-#ifdef INET6
-aodv_v6_rreq(netdissect_options *ndo,
-             const struct aodv_rreq6 *ap, const u_char *dat, u_int length)
-#else
-aodv_v6_rreq(netdissect_options *ndo,
-             const struct aodv_rreq6 *ap _U_, const u_char *dat _U_, u_int length)
-#endif
+aodv_v6_rreq(netdissect_options *ndo, const u_char *dat, u_int length)

 {
 {

-#ifdef INET6

        u_int i;
        u_int i;

+       const struct aodv_rreq6 *ap = (const struct aodv_rreq6 *)dat;

 
 

-       if (ndo->ndo_snapend < dat) {
-               ND_PRINT((ndo, " [|aodv]"));
-               return;
-       }
-       i = min(length, (u_int)(ndo->ndo_snapend - dat));
-       if (i < sizeof(*ap)) {
-               ND_PRINT((ndo, " [|rreq6]"));
-               return;
-       }
-       i -= sizeof(*ap);
+       ND_TCHECK(*ap);
+       if (length < sizeof(*ap))
+               goto trunc;

        ND_PRINT((ndo, " v6 rreq %u %s%s%s%s%shops %u id 0x%08lx\n"
            "\tdst %s seq %lu src %s seq %lu", length,
            ap->rreq_type & RREQ_JOIN ? "[J]" : "",
        ND_PRINT((ndo, " v6 rreq %u %s%s%s%s%shops %u id 0x%08lx\n"
            "\tdst %s seq %lu src %s seq %lu", length,
            ap->rreq_type & RREQ_JOIN ? "[J]" : "",


@@ -348,35 +309,24 @@ aodv_v6_rreq(netdissect_options *ndo,
            (unsigned long)EXTRACT_32BITS(&ap->rreq_ds),
            ip6addr_string(ndo, &ap->rreq_oa),
            (unsigned long)EXTRACT_32BITS(&ap->rreq_os)));
            (unsigned long)EXTRACT_32BITS(&ap->rreq_ds),
            ip6addr_string(ndo, &ap->rreq_oa),
            (unsigned long)EXTRACT_32BITS(&ap->rreq_os)));

+       i = length - sizeof(*ap);

        if (i >= sizeof(struct aodv_ext))
        if (i >= sizeof(struct aodv_ext))

-               aodv_extension(ndo, (void *)(ap + 1), i);
-#else
-       ND_PRINT((ndo, " v6 rreq %u", length));
-#endif
+               aodv_extension(ndo, (const struct aodv_ext *)(dat + sizeof(*ap)), i);
+       return;
+
+trunc:
+       ND_PRINT((ndo, " [|rreq"));

 }
 
 static void
 }
 
 static void

-#ifdef INET6
-aodv_v6_rrep(netdissect_options *ndo,
-             const struct aodv_rrep6 *ap, const u_char *dat, u_int length)
-#else
-aodv_v6_rrep(netdissect_options *ndo,
-             const struct aodv_rrep6 *ap _U_, const u_char *dat _U_, u_int length)
-#endif
+aodv_v6_rrep(netdissect_options *ndo, const u_char *dat, u_int length)

 {
 {

-#ifdef INET6

        u_int i;
        u_int i;

+       const struct aodv_rrep6 *ap = (const struct aodv_rrep6 *)dat;

 
 

-       if (ndo->ndo_snapend < dat) {
-               ND_PRINT((ndo, " [|aodv]"));
-               return;
-       }
-       i = min(length, (u_int)(ndo->ndo_snapend - dat));
-       if (i < sizeof(*ap)) {
-               ND_PRINT((ndo, " [|rrep6]"));
-               return;
-       }
-       i -= sizeof(*ap);
+       ND_TCHECK(*ap);
+       if (length < sizeof(*ap))
+               goto trunc;

        ND_PRINT((ndo, " rrep %u %s%sprefix %u hops %u\n"
           "\tdst %s dseq %lu src %s %lu ms", length,
            ap->rrep_type & RREP_REPAIR ? "[R]" : "",
        ND_PRINT((ndo, " rrep %u %s%sprefix %u hops %u\n"
           "\tdst %s dseq %lu src %s %lu ms", length,
            ap->rrep_type & RREP_REPAIR ? "[R]" : "",


@@ -387,67 +337,54 @@ aodv_v6_rrep(netdissect_options *ndo,
            (unsigned long)EXTRACT_32BITS(&ap->rrep_ds),
            ip6addr_string(ndo, &ap->rrep_oa),
            (unsigned long)EXTRACT_32BITS(&ap->rrep_life)));
            (unsigned long)EXTRACT_32BITS(&ap->rrep_ds),
            ip6addr_string(ndo, &ap->rrep_oa),
            (unsigned long)EXTRACT_32BITS(&ap->rrep_life)));

+       i = length - sizeof(*ap);

        if (i >= sizeof(struct aodv_ext))
        if (i >= sizeof(struct aodv_ext))

-               aodv_extension(ndo, (void *)(ap + 1), i);
-#else
-       ND_PRINT((ndo, " rrep %u", length));
-#endif
+               aodv_extension(ndo, (const struct aodv_ext *)(dat + sizeof(*ap)), i);
+       return;
+
+trunc:
+       ND_PRINT((ndo, " [|rreq"));

 }
 
 static void
 }
 
 static void

-#ifdef INET6
-aodv_v6_rerr(netdissect_options *ndo,
-             const struct aodv_rerr *ap, u_int length)
-#else
-aodv_v6_rerr(netdissect_options *ndo,
-             const struct aodv_rerr *ap _U_, u_int length)
-#endif
+aodv_v6_rerr(netdissect_options *ndo, const u_char *dat, u_int length)

 {
 {

-#ifdef INET6
-       const struct rerr_unreach6 *dp6 = NULL;
-       int i, j, n, trunc;
-
-       i = length - offsetof(struct aodv_rerr, r);
-       j = sizeof(ap->r.dest6[0]);
-       dp6 = &ap->r.dest6[0];
-       n = ap->rerr_dc * j;
+       u_int i, dc;
+       const struct aodv_rerr *ap = (const struct aodv_rerr *)dat;
+       const struct rerr_unreach6 *dp6;
+
+       ND_TCHECK(*ap);
+       if (length < sizeof(*ap))
+               goto trunc;

        ND_PRINT((ndo, " rerr %s [items %u] [%u]:",
            ap->rerr_flags & RERR_NODELETE ? "[D]" : "",
            ap->rerr_dc, length));
        ND_PRINT((ndo, " rerr %s [items %u] [%u]:",
            ap->rerr_flags & RERR_NODELETE ? "[D]" : "",
            ap->rerr_dc, length));

-       trunc = n - (i/j);
-       for (; i -= j >= 0; ++dp6) {
+       dp6 = (const struct rerr_unreach6 *)(const void *)(ap + 1);
+       i = length - sizeof(*ap);
+       for (dc = ap->rerr_dc; dc != 0; dc--) {
+               ND_TCHECK(*dp6);
+               if (i < sizeof(*dp6))
+                       goto trunc;

                ND_PRINT((ndo, " {%s}(%ld)", ip6addr_string(ndo, &dp6->u_da),
                    (unsigned long)EXTRACT_32BITS(&dp6->u_ds)));
                ND_PRINT((ndo, " {%s}(%ld)", ip6addr_string(ndo, &dp6->u_da),
                    (unsigned long)EXTRACT_32BITS(&dp6->u_ds)));

+               dp6++;
+               i -= sizeof(*dp6);

        }
        }

-       if (trunc)
-               ND_PRINT((ndo, "[|rerr]"));
-#else
-       ND_PRINT((ndo, " rerr %u", length));
-#endif
+       return;
+
+trunc:
+       ND_PRINT((ndo, "[|rerr]"));

 }
 
 static void
 }
 
 static void

-#ifdef INET6
-aodv_v6_draft_01_rreq(netdissect_options *ndo,
-                      const struct aodv_rreq6_draft_01 *ap, const u_char *dat, u_int length)
-#else
-aodv_v6_draft_01_rreq(netdissect_options *ndo,
-                      const struct aodv_rreq6_draft_01 *ap _U_, const u_char *dat _U_, u_int length)
-#endif
+aodv_v6_draft_01_rreq(netdissect_options *ndo, const u_char *dat, u_int length)

 {
 {

-#ifdef INET6

        u_int i;
        u_int i;

+       const struct aodv_rreq6_draft_01 *ap = (const struct aodv_rreq6_draft_01 *)dat;

 
 

-       if (ndo->ndo_snapend < dat) {
-               ND_PRINT((ndo, " [|aodv]"));
-               return;
-       }
-       i = min(length, (u_int)(ndo->ndo_snapend - dat));
-       if (i < sizeof(*ap)) {
-               ND_PRINT((ndo, " [|rreq6]"));
-               return;
-       }
-       i -= sizeof(*ap);
+       ND_TCHECK(*ap);
+       if (length < sizeof(*ap))
+               goto trunc;

        ND_PRINT((ndo, " rreq %u %s%s%s%s%shops %u id 0x%08lx\n"
            "\tdst %s seq %lu src %s seq %lu", length,
            ap->rreq_type & RREQ_JOIN ? "[J]" : "",
        ND_PRINT((ndo, " rreq %u %s%s%s%s%shops %u id 0x%08lx\n"
            "\tdst %s seq %lu src %s seq %lu", length,
            ap->rreq_type & RREQ_JOIN ? "[J]" : "",


@@ -461,35 +398,24 @@ aodv_v6_draft_01_rreq(netdissect_options *ndo,
            (unsigned long)EXTRACT_32BITS(&ap->rreq_ds),
            ip6addr_string(ndo, &ap->rreq_oa),
            (unsigned long)EXTRACT_32BITS(&ap->rreq_os)));
            (unsigned long)EXTRACT_32BITS(&ap->rreq_ds),
            ip6addr_string(ndo, &ap->rreq_oa),
            (unsigned long)EXTRACT_32BITS(&ap->rreq_os)));

+       i = length - sizeof(*ap);

        if (i >= sizeof(struct aodv_ext))
        if (i >= sizeof(struct aodv_ext))

-               aodv_extension(ndo, (void *)(ap + 1), i);
-#else
-       ND_PRINT((ndo, " rreq %u", length));
-#endif
+               aodv_extension(ndo, (const struct aodv_ext *)(dat + sizeof(*ap)), i);
+       return;
+
+trunc:
+       ND_PRINT((ndo, " [|rreq"));

 }
 
 static void
 }
 
 static void

-#ifdef INET6
-aodv_v6_draft_01_rrep(netdissect_options *ndo,
-                      const struct aodv_rrep6_draft_01 *ap, const u_char *dat, u_int length)
-#else
-aodv_v6_draft_01_rrep(netdissect_options *ndo,
-                      const struct aodv_rrep6_draft_01 *ap _U_, const u_char *dat _U_, u_int length)
-#endif
+aodv_v6_draft_01_rrep(netdissect_options *ndo, const u_char *dat, u_int length)

 {
 {

-#ifdef INET6

        u_int i;
        u_int i;

+       const struct aodv_rrep6_draft_01 *ap = (const struct aodv_rrep6_draft_01 *)dat;

 
 

-       if (ndo->ndo_snapend < dat) {
-               ND_PRINT((ndo, " [|aodv]"));
-               return;
-       }
-       i = min(length, (u_int)(ndo->ndo_snapend - dat));
-       if (i < sizeof(*ap)) {
-               ND_PRINT((ndo, " [|rrep6]"));
-               return;
-       }
-       i -= sizeof(*ap);
+       ND_TCHECK(*ap);
+       if (length < sizeof(*ap))
+               goto trunc;

        ND_PRINT((ndo, " rrep %u %s%sprefix %u hops %u\n"
           "\tdst %s dseq %lu src %s %lu ms", length,
            ap->rrep_type & RREP_REPAIR ? "[R]" : "",
        ND_PRINT((ndo, " rrep %u %s%sprefix %u hops %u\n"
           "\tdst %s dseq %lu src %s %lu ms", length,
            ap->rrep_type & RREP_REPAIR ? "[R]" : "",


@@ -500,43 +426,43 @@ aodv_v6_draft_01_rrep(netdissect_options *ndo,
            (unsigned long)EXTRACT_32BITS(&ap->rrep_ds),
            ip6addr_string(ndo, &ap->rrep_oa),
            (unsigned long)EXTRACT_32BITS(&ap->rrep_life)));
            (unsigned long)EXTRACT_32BITS(&ap->rrep_ds),
            ip6addr_string(ndo, &ap->rrep_oa),
            (unsigned long)EXTRACT_32BITS(&ap->rrep_life)));

+       i = length - sizeof(*ap);

        if (i >= sizeof(struct aodv_ext))
        if (i >= sizeof(struct aodv_ext))

-               aodv_extension(ndo, (void *)(ap + 1), i);
-#else
-       ND_PRINT((ndo, " rrep %u", length));
-#endif
+               aodv_extension(ndo, (const struct aodv_ext *)(dat + sizeof(*ap)), i);
+       return;
+
+trunc:
+       ND_PRINT((ndo, " [|rreq"));

 }
 
 static void
 }
 
 static void

-#ifdef INET6
-aodv_v6_draft_01_rerr(netdissect_options *ndo,
-                      const struct aodv_rerr *ap, u_int length)
-#else
-aodv_v6_draft_01_rerr(netdissect_options *ndo,
-                      const struct aodv_rerr *ap _U_, u_int length)
-#endif
+aodv_v6_draft_01_rerr(netdissect_options *ndo, const u_char *dat, u_int length)

 {
 {

-#ifdef INET6
-       const struct rerr_unreach6_draft_01 *dp6 = NULL;
-       int i, j, n, trunc;
-
-       i = length - offsetof(struct aodv_rerr, r);
-       j = sizeof(ap->r.dest6_draft_01[0]);
-       dp6 = &ap->r.dest6_draft_01[0];
-       n = ap->rerr_dc * j;
+       u_int i, dc;
+       const struct aodv_rerr *ap = (const struct aodv_rerr *)dat;
+       const struct rerr_unreach6_draft_01 *dp6;
+
+       ND_TCHECK(*ap);
+       if (length < sizeof(*ap))
+               goto trunc;

        ND_PRINT((ndo, " rerr %s [items %u] [%u]:",
            ap->rerr_flags & RERR_NODELETE ? "[D]" : "",
            ap->rerr_dc, length));
        ND_PRINT((ndo, " rerr %s [items %u] [%u]:",
            ap->rerr_flags & RERR_NODELETE ? "[D]" : "",
            ap->rerr_dc, length));

-       trunc = n - (i/j);
-       for (; i -= j >= 0; ++dp6) {
+       dp6 = (const struct rerr_unreach6_draft_01 *)(const void *)(ap + 1);
+       i = length - sizeof(*ap);
+       for (dc = ap->rerr_dc; dc != 0; dc--) {
+               ND_TCHECK(*dp6);
+               if (i < sizeof(*dp6))
+                       goto trunc;

                ND_PRINT((ndo, " {%s}(%ld)", ip6addr_string(ndo, &dp6->u_da),
                    (unsigned long)EXTRACT_32BITS(&dp6->u_ds)));
                ND_PRINT((ndo, " {%s}(%ld)", ip6addr_string(ndo, &dp6->u_da),
                    (unsigned long)EXTRACT_32BITS(&dp6->u_ds)));

+               dp6++;
+               i -= sizeof(*dp6);

        }
        }

-       if (trunc)
-               ND_PRINT((ndo, "[|rerr]"));
-#else
-       ND_PRINT((ndo, " rerr %u", length));
-#endif
+       return;
+
+trunc:
+       ND_PRINT((ndo, "[|rerr]"));

 }
 
 void
 }
 
 void


@@ -557,23 +483,23 @@ aodv_print(netdissect_options *ndo,
 
        case AODV_RREQ:
                if (is_ip6)
 
        case AODV_RREQ:
                if (is_ip6)

-                       aodv_v6_rreq(ndo, (const struct aodv_rreq6 *)dat, dat, length);
+                       aodv_v6_rreq(ndo, dat, length);

                else
                else

-                       aodv_rreq(ndo, (const struct aodv_rreq *)dat, dat, length);
+                       aodv_rreq(ndo, dat, length);

                break;
 
        case AODV_RREP:
                if (is_ip6)
                break;
 
        case AODV_RREP:
                if (is_ip6)

-                       aodv_v6_rrep(ndo, (const struct aodv_rrep6 *)dat, dat, length);
+                       aodv_v6_rrep(ndo, dat, length);

                else
                else

-                       aodv_rrep(ndo, (const struct aodv_rrep *)dat, dat, length);
+                       aodv_rrep(ndo, dat, length);

                break;
 
        case AODV_RERR:
                if (is_ip6)
                break;
 
        case AODV_RERR:
                if (is_ip6)

-                       aodv_v6_rerr(ndo, (const struct aodv_rerr *)dat, length);
+                       aodv_v6_rerr(ndo, dat, length);

                else
                else

-                       aodv_rerr(ndo, (const struct aodv_rerr *)dat, dat, length);
+                       aodv_rerr(ndo, dat, length);

                break;
 
        case AODV_RREP_ACK:
                break;
 
        case AODV_RREP_ACK:


@@ -581,15 +507,15 @@ aodv_print(netdissect_options *ndo,
                break;
 
        case AODV_V6_DRAFT_01_RREQ:
                break;
 
        case AODV_V6_DRAFT_01_RREQ:

-               aodv_v6_draft_01_rreq(ndo, (const struct aodv_rreq6_draft_01 *)dat, dat, length);
+               aodv_v6_draft_01_rreq(ndo, dat, length);

                break;
 
        case AODV_V6_DRAFT_01_RREP:
                break;
 
        case AODV_V6_DRAFT_01_RREP:

-               aodv_v6_draft_01_rrep(ndo, (const struct aodv_rrep6_draft_01 *)dat, dat, length);
+               aodv_v6_draft_01_rrep(ndo, dat, length);

                break;
 
        case AODV_V6_DRAFT_01_RERR:
                break;
 
        case AODV_V6_DRAFT_01_RERR:

-               aodv_v6_draft_01_rerr(ndo, (const struct aodv_rerr *)dat, length);
+               aodv_v6_draft_01_rerr(ndo, dat, length);

                break;
 
        case AODV_V6_DRAFT_01_RREP_ACK:
                break;
 
        case AODV_V6_DRAFT_01_RREP_ACK: