CVE-2017-13045/VQP: add some bounds checks

[tcpdump] / print-bootp.c

diff --git a/print-bootp.c b/print-bootp.c
index d16bd9db854d96bf378b6df9c85aff3d3a469738..d87911fdb206af48ffeffec146f849f48d9c175c 100644 (file)
--- a/print-bootp.c
+++ b/print-bootp.c
@@ -212,8 +212,9 @@ struct bootp {
 #define        TAG_CLIENT_GUID         ((uint8_t)  97)
 #define        TAG_LDAP_URL            ((uint8_t)  95)
 #define        TAG_6OVER4              ((uint8_t)  96)
-#define        TAG_PRINTER_NAME        ((uint8_t) 100)
-#define        TAG_MDHCP_SERVER        ((uint8_t) 101)
+/* RFC 4833, TZ codes */
+#define        TAG_TZ_PCODE            ((uint8_t) 100)
+#define        TAG_TZ_TCODE            ((uint8_t) 101)
 #define        TAG_IPX_COMPAT          ((uint8_t) 110)
 #define        TAG_NETINFO_PARENT      ((uint8_t) 112)
 #define        TAG_NETINFO_PARENT_TAG  ((uint8_t) 113)
@@ -221,6 +222,7 @@ struct bootp {
 #define        TAG_FAILOVER            ((uint8_t) 115)
 #define        TAG_EXTENDED_REQUEST    ((uint8_t) 126)
 #define        TAG_EXTENDED_OPTION     ((uint8_t) 127)
+#define TAG_MUDURL              ((uint8_t) 161)
 
 /* DHCP Message types (values for TAG_DHCP_MESSAGE option) */
 #define DHCPDISCOVER   1
@@ -291,6 +293,7 @@ bootp_print(netdissect_options *ndo,
        ND_PRINT((ndo, "BOOTP/DHCP, %s",
                  tok2str(bootp_op_values, "unknown (0x%02x)", bp->bp_op)));
 
+       ND_TCHECK(bp->bp_hlen);
        if (bp->bp_htype == 1 && bp->bp_hlen == 6 && bp->bp_op == BOOTPREQUEST) {
                ND_TCHECK2(bp->bp_chaddr[0], 6);
                ND_PRINT((ndo, " from %s", etheraddr_string(ndo, bp->bp_chaddr)));
@@ -319,6 +322,7 @@ bootp_print(netdissect_options *ndo,
        if (EXTRACT_16BITS(&bp->bp_secs))
                ND_PRINT((ndo, ", secs %d", EXTRACT_16BITS(&bp->bp_secs)));
 
+       ND_TCHECK(bp->bp_flags);
        ND_PRINT((ndo, ", Flags [%s]",
                  bittok2str(bootp_flag_values, "none", EXTRACT_16BITS(&bp->bp_flags))));
        if (ndo->ndo_vflag > 1)
@@ -353,7 +357,8 @@ bootp_print(netdissect_options *ndo,
        ND_TCHECK2(bp->bp_sname[0], 1);         /* check first char only */
        if (*bp->bp_sname) {
                ND_PRINT((ndo, "\n\t  sname \""));
-               if (fn_print(ndo, bp->bp_sname, ndo->ndo_snapend)) {
+               if (fn_printztn(ndo, bp->bp_sname, (u_int)sizeof bp->bp_sname,
+                   ndo->ndo_snapend)) {
                        ND_PRINT((ndo, "\""));
                        ND_PRINT((ndo, "%s", tstr + 1));
                        return;
@@ -363,7 +368,8 @@ bootp_print(netdissect_options *ndo,
        ND_TCHECK2(bp->bp_file[0], 1);          /* check first char only */
        if (*bp->bp_file) {
                ND_PRINT((ndo, "\n\t  file \""));
-               if (fn_print(ndo, bp->bp_file, ndo->ndo_snapend)) {
+               if (fn_printztn(ndo, bp->bp_file, (u_int)sizeof bp->bp_file,
+                   ndo->ndo_snapend)) {
                        ND_PRINT((ndo, "\""));
                        ND_PRINT((ndo, "%s", tstr + 1));
                        return;
@@ -519,13 +525,14 @@ static const struct tok tag2str[] = {
        { TAG_CLIENT_GUID,      "bGUID" },      /* XXX 'b' */
        { TAG_LDAP_URL,         "aLDAP" },
        { TAG_6OVER4,           "i6o4" },
-       { TAG_PRINTER_NAME,     "aPRTR" },
-       { TAG_MDHCP_SERVER,     "bMDHCP" },     /* XXX 'b' */
+       { TAG_TZ_PCODE,         "aPOSIX-TZ" },
+       { TAG_TZ_TCODE,         "aTZ-Name" },
        { TAG_IPX_COMPAT,       "bIPX" },       /* XXX 'b' */
        { TAG_NETINFO_PARENT,   "iNI" },
        { TAG_NETINFO_PARENT_TAG, "aNITAG" },
        { TAG_URL,              "aURL" },
        { TAG_FAILOVER,         "bFAIL" },      /* XXX 'b' */
+       { TAG_MUDURL,           "aMUD-URL" },
        { 0, NULL }
 };
 /* 2-byte extended tags */