CVE-2016-7925/Add more bounds checks.

[tcpdump] / print-isoclns.c

diff --git a/print-isoclns.c b/print-isoclns.c
index bf9617f990ac2287148aa8ac69b3cf2cbe216f6b..0d63679cf145c6aa4c29310a963d34d7bd19be38 100644 (file)
--- a/print-isoclns.c
+++ b/print-isoclns.c
@@ -24,6 +24,8 @@
  * complete IS-IS & CLNP support.
  */
 
  * complete IS-IS & CLNP support.
  */
 

+/* \summary: ISO CLNS, ESIS, and ISIS printer */
+

 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif


@@ -1304,12 +1306,8 @@ isis_print_mcid(netdissect_options *ndo,
   ND_TCHECK(*mcid);
   ND_PRINT((ndo,  "ID: %d, Name: ", mcid->format_id));
 
   ND_TCHECK(*mcid);
   ND_PRINT((ndo,  "ID: %d, Name: ", mcid->format_id));
 

-  for(i=0; i<32; i++)
-  {
-    ND_PRINT((ndo, "%c", mcid->name[i]));
-    if(mcid->name[i] == '\0')
-        break;
-  }
+  if (fn_printzp(ndo, mcid->name, 32, ndo->ndo_snapend))
+    goto trunc;

 
   ND_PRINT((ndo, "\n\t              Lvl: %d", EXTRACT_16BITS(mcid->revision_lvl)));
 
 
   ND_PRINT((ndo, "\n\t              Lvl: %d", EXTRACT_16BITS(mcid->revision_lvl)));
 


@@ -1348,8 +1346,7 @@ isis_print_mt_port_cap_subtlv(netdissect_options *ndo,
     {
       case ISIS_SUBTLV_SPB_MCID:
       {
     {
       case ISIS_SUBTLV_SPB_MCID:
       {

-        if (!ND_TTEST2(*(tptr), ISIS_SUBTLV_SPB_MCID_MIN_LEN))
-          goto trunctlv;
+        ND_TCHECK2(*(tptr), ISIS_SUBTLV_SPB_MCID_MIN_LEN);

 
         subtlv_spb_mcid = (const struct isis_subtlv_spb_mcid *)tptr;
 
 
         subtlv_spb_mcid = (const struct isis_subtlv_spb_mcid *)tptr;
 


@@ -1372,8 +1369,7 @@ isis_print_mt_port_cap_subtlv(netdissect_options *ndo,
 
       case ISIS_SUBTLV_SPB_DIGEST:
       {
 
       case ISIS_SUBTLV_SPB_DIGEST:
       {

-        if (!ND_TTEST2(*(tptr), ISIS_SUBTLV_SPB_DIGEST_MIN_LEN))
-          goto trunctlv;
+        ND_TCHECK2(*(tptr), ISIS_SUBTLV_SPB_DIGEST_MIN_LEN);

 
         ND_PRINT((ndo, "\n\t        RES: %d V: %d A: %d D: %d",
                         (*(tptr) >> 5), (((*tptr)>> 4) & 0x01),
 
         ND_PRINT((ndo, "\n\t        RES: %d V: %d A: %d D: %d",
                         (*(tptr) >> 5), (((*tptr)>> 4) & 0x01),


@@ -1398,13 +1394,11 @@ isis_print_mt_port_cap_subtlv(netdissect_options *ndo,
 
       case ISIS_SUBTLV_SPB_BVID:
       {
 
       case ISIS_SUBTLV_SPB_BVID:
       {

-        if (!ND_TTEST2(*(tptr), stlv_len))
-          goto trunctlv;
+        ND_TCHECK2(*(tptr), stlv_len);

 
         while (len >= ISIS_SUBTLV_SPB_BVID_MIN_LEN)
         {
 
         while (len >= ISIS_SUBTLV_SPB_BVID_MIN_LEN)
         {

-          if (!ND_TTEST2(*(tptr), ISIS_SUBTLV_SPB_BVID_MIN_LEN))
-            goto trunctlv;
+          ND_TCHECK2(*(tptr), ISIS_SUBTLV_SPB_BVID_MIN_LEN);

 
           ND_PRINT((ndo, "\n\t           ECT: %08x",
                       EXTRACT_32BITS(tptr)));
 
           ND_PRINT((ndo, "\n\t           ECT: %08x",
                       EXTRACT_32BITS(tptr)));


@@ -1430,7 +1424,7 @@ isis_print_mt_port_cap_subtlv(netdissect_options *ndo,
 
   return 0;
 
 
   return 0;
 

-  trunctlv:
+  trunc:

     ND_PRINT((ndo, "\n\t\t"));
     ND_PRINT((ndo, "%s", tstr));
     return(1);
     ND_PRINT((ndo, "\n\t\t"));
     ND_PRINT((ndo, "%s", tstr));
     return(1);


@@ -1674,8 +1668,7 @@ isis_print_ip_reach_subtlv(netdissect_options *ndo,
                  ident, tok2str(isis_ext_ip_reach_subtlv_values, "unknown", subt),
                  subt, subl));
 
                  ident, tok2str(isis_ext_ip_reach_subtlv_values, "unknown", subt),
                  subt, subl));
 

-       if (!ND_TTEST2(*tptr,subl))
-           goto trunctlv;
+       ND_TCHECK2(*tptr,subl);

 
     switch(subt) {
     case ISIS_SUBTLV_EXTD_IP_REACH_MGMT_PREFIX_COLOR: /* fall through */
 
     switch(subt) {
     case ISIS_SUBTLV_EXTD_IP_REACH_MGMT_PREFIX_COLOR: /* fall through */


@@ -1704,7 +1697,7 @@ isis_print_ip_reach_subtlv(netdissect_options *ndo,
     }
     return(1);
 
     }
     return(1);
 

-trunctlv:
+trunc:

     ND_PRINT((ndo, "%s", ident));
     ND_PRINT((ndo, "%s", tstr));
     return(0);
     ND_PRINT((ndo, "%s", ident));
     ND_PRINT((ndo, "%s", tstr));
     return(0);


@@ -1871,7 +1864,6 @@ trunc:
     return(0);
 }
 
     return(0);
 }
 

-

 /*
  * this is the common IS-REACH decoder it is called
  * from various EXTD-IS REACH style TLVs (22,24,222)
 /*
  * this is the common IS-REACH decoder it is called
  * from various EXTD-IS REACH style TLVs (22,24,222)


@@ -2055,6 +2047,20 @@ isis_print_extd_ip_reach(netdissect_options *ndo,
     return (processed);
 }
 
     return (processed);
 }
 

+/*
+ * Clear checksum and lifetime prior to signature verification.
+ */
+static void
+isis_clear_checksum_lifetime(void *header)
+{
+    struct isis_lsp_header *header_lsp = (struct isis_lsp_header *) header;
+
+    header_lsp->checksum[0] = 0;
+    header_lsp->checksum[1] = 0;
+    header_lsp->remaining_lifetime[0] = 0;
+    header_lsp->remaining_lifetime[1] = 0;
+}
+

 /*
  * isis_print
  * Decode IS-IS packets.  Return 0 on error.
 /*
  * isis_print
  * Decode IS-IS packets.  Return 0 on error.


@@ -2068,7 +2074,7 @@ isis_print(netdissect_options *ndo,
 
     const struct isis_iih_lan_header *header_iih_lan;
     const struct isis_iih_ptp_header *header_iih_ptp;
 
     const struct isis_iih_lan_header *header_iih_lan;
     const struct isis_iih_ptp_header *header_iih_ptp;

-    struct isis_lsp_header *header_lsp;
+    const struct isis_lsp_header *header_lsp;

     const struct isis_csnp_header *header_csnp;
     const struct isis_psnp_header *header_psnp;
 
     const struct isis_csnp_header *header_csnp;
     const struct isis_psnp_header *header_psnp;
 


@@ -2093,7 +2099,7 @@ isis_print(netdissect_options *ndo,
     pptr = p+(ISIS_COMMON_HEADER_SIZE);
     header_iih_lan = (const struct isis_iih_lan_header *)pptr;
     header_iih_ptp = (const struct isis_iih_ptp_header *)pptr;
     pptr = p+(ISIS_COMMON_HEADER_SIZE);
     header_iih_lan = (const struct isis_iih_lan_header *)pptr;
     header_iih_ptp = (const struct isis_iih_ptp_header *)pptr;

-    header_lsp = (struct isis_lsp_header *)pptr;
+    header_lsp = (const struct isis_lsp_header *)pptr;

     header_csnp = (const struct isis_csnp_header *)pptr;
     header_psnp = (const struct isis_psnp_header *)pptr;
 
     header_csnp = (const struct isis_csnp_header *)pptr;
     header_psnp = (const struct isis_psnp_header *)pptr;
 


@@ -2320,21 +2326,11 @@ isis_print(netdissect_options *ndo,
                EXTRACT_16BITS(header_lsp->remaining_lifetime),
                EXTRACT_16BITS(header_lsp->checksum)));
 
                EXTRACT_16BITS(header_lsp->remaining_lifetime),
                EXTRACT_16BITS(header_lsp->checksum)));
 

-
-        if (osi_print_cksum(ndo, (uint8_t *)header_lsp->lsp_id,
+        if (osi_print_cksum(ndo, (const uint8_t *)header_lsp->lsp_id,

                             EXTRACT_16BITS(header_lsp->checksum),
                             12, length-12) == 0)
                                 goto trunc;
 
                             EXTRACT_16BITS(header_lsp->checksum),
                             12, length-12) == 0)
                                 goto trunc;
 

-        /*
-         * Clear checksum and lifetime prior to signature verification.
-         */
-        header_lsp->checksum[0] = 0;
-        header_lsp->checksum[1] = 0;
-        header_lsp->remaining_lifetime[0] = 0;
-        header_lsp->remaining_lifetime[1] = 0;
-
-

        ND_PRINT((ndo, ", PDU length: %u, Flags: [ %s",
                pdu_len,
                ISIS_MASK_LSP_OL_BIT(header_lsp->typeblock) ? "Overload bit set, " : ""));
        ND_PRINT((ndo, ", PDU length: %u, Flags: [ %s",
                pdu_len,
                ISIS_MASK_LSP_OL_BIT(header_lsp->typeblock) ? "Overload bit set, " : ""));


@@ -2457,8 +2453,7 @@ isis_print(netdissect_options *ndo,
         /* now check if we have a decoder otherwise do a hexdump at the end*/
        switch (tlv_type) {
        case ISIS_TLV_AREA_ADDR:
         /* now check if we have a decoder otherwise do a hexdump at the end*/
        switch (tlv_type) {
        case ISIS_TLV_AREA_ADDR:

-           if (!ND_TTEST2(*tptr, 1))
-               goto trunctlv;
+           ND_TCHECK2(*tptr, 1);

            alen = *tptr++;
            while (tmp && alen < tmp) {
                ND_PRINT((ndo, "\n\t      Area address (length: %u): %s",
            alen = *tptr++;
            while (tmp && alen < tmp) {
                ND_PRINT((ndo, "\n\t      Area address (length: %u): %s",


@@ -2468,15 +2463,13 @@ isis_print(netdissect_options *ndo,
                tmp -= alen + 1;
                if (tmp==0) /* if this is the last area address do not attemt a boundary check */
                     break;
                tmp -= alen + 1;
                if (tmp==0) /* if this is the last area address do not attemt a boundary check */
                     break;

-               if (!ND_TTEST2(*tptr, 1))
-                   goto trunctlv;
+               ND_TCHECK2(*tptr, 1);

                alen = *tptr++;
            }
            break;
        case ISIS_TLV_ISNEIGH:
            while (tmp >= ETHER_ADDR_LEN) {
                alen = *tptr++;
            }
            break;
        case ISIS_TLV_ISNEIGH:
            while (tmp >= ETHER_ADDR_LEN) {

-                if (!ND_TTEST2(*tptr, ETHER_ADDR_LEN))
-                    goto trunctlv;
+                ND_TCHECK2(*tptr, ETHER_ADDR_LEN);

                 ND_PRINT((ndo, "\n\t      SNPA: %s", isis_print_id(tptr, ETHER_ADDR_LEN)));
                 tmp -= ETHER_ADDR_LEN;
                 tptr += ETHER_ADDR_LEN;
                 ND_PRINT((ndo, "\n\t      SNPA: %s", isis_print_id(tptr, ETHER_ADDR_LEN)));
                 tmp -= ETHER_ADDR_LEN;
                 tptr += ETHER_ADDR_LEN;


@@ -2494,8 +2487,7 @@ isis_print(netdissect_options *ndo,
             tmp --;
             ND_PRINT((ndo, "\n\t      LAN address length %u bytes ", lan_alen));
            while (tmp >= lan_alen) {
             tmp --;
             ND_PRINT((ndo, "\n\t      LAN address length %u bytes ", lan_alen));
            while (tmp >= lan_alen) {

-                if (!ND_TTEST2(*tptr, lan_alen))
-                    goto trunctlv;
+                ND_TCHECK2(*tptr, lan_alen);

                 ND_PRINT((ndo, "\n\t\tIS Neighbor: %s", isis_print_id(tptr, lan_alen)));
                 tmp -= lan_alen;
                 tptr +=lan_alen;
                 ND_PRINT((ndo, "\n\t\tIS Neighbor: %s", isis_print_id(tptr, lan_alen)));
                 tmp -= lan_alen;
                 tptr +=lan_alen;


@@ -2541,16 +2533,14 @@ isis_print(netdissect_options *ndo,
             }
             break;
         case ISIS_TLV_IS_REACH:
             }
             break;
         case ISIS_TLV_IS_REACH:

-           if (!ND_TTEST2(*tptr,1))  /* check if there is one byte left to read out the virtual flag */
-                goto trunctlv;
+           ND_TCHECK2(*tptr,1);  /* check if there is one byte left to read out the virtual flag */

             ND_PRINT((ndo, "\n\t      %s",
                    tok2str(isis_is_reach_virtual_values,
                            "bogus virtual flag 0x%02x",
                            *tptr++)));
            tlv_is_reach = (const struct isis_tlv_is_reach *)tptr;
             while (tmp >= sizeof(struct isis_tlv_is_reach)) {
             ND_PRINT((ndo, "\n\t      %s",
                    tok2str(isis_is_reach_virtual_values,
                            "bogus virtual flag 0x%02x",
                            *tptr++)));
            tlv_is_reach = (const struct isis_tlv_is_reach *)tptr;
             while (tmp >= sizeof(struct isis_tlv_is_reach)) {

-               if (!ND_TTEST(*tlv_is_reach))
-                   goto trunctlv;
+               ND_TCHECK(*tlv_is_reach);

                ND_PRINT((ndo, "\n\t      IS Neighbor: %s",
                       isis_print_id(tlv_is_reach->neighbor_nodeid, NODE_ID_LEN)));
                isis_print_metric_block(ndo, &tlv_is_reach->isis_metric_block);
                ND_PRINT((ndo, "\n\t      IS Neighbor: %s",
                       isis_print_id(tlv_is_reach->neighbor_nodeid, NODE_ID_LEN)));
                isis_print_metric_block(ndo, &tlv_is_reach->isis_metric_block);


@@ -2562,8 +2552,7 @@ isis_print(netdissect_options *ndo,
         case ISIS_TLV_ESNEIGH:
            tlv_es_reach = (const struct isis_tlv_es_reach *)tptr;
             while (tmp >= sizeof(struct isis_tlv_es_reach)) {
         case ISIS_TLV_ESNEIGH:
            tlv_es_reach = (const struct isis_tlv_es_reach *)tptr;
             while (tmp >= sizeof(struct isis_tlv_es_reach)) {

-               if (!ND_TTEST(*tlv_es_reach))
-                   goto trunctlv;
+               ND_TCHECK(*tlv_es_reach);

                ND_PRINT((ndo, "\n\t      ES Neighbor: %s",
                        isis_print_id(tlv_es_reach->neighbor_sysid, SYSTEM_ID_LEN)));
                isis_print_metric_block(ndo, &tlv_es_reach->isis_metric_block);
                ND_PRINT((ndo, "\n\t      ES Neighbor: %s",
                        isis_print_id(tlv_es_reach->neighbor_sysid, SYSTEM_ID_LEN)));
                isis_print_metric_block(ndo, &tlv_es_reach->isis_metric_block);


@@ -2635,8 +2624,7 @@ isis_print(netdissect_options *ndo,
 
        case ISIS_TLV_IP6ADDR:
            while (tmp>=sizeof(struct in6_addr)) {
 
        case ISIS_TLV_IP6ADDR:
            while (tmp>=sizeof(struct in6_addr)) {

-               if (!ND_TTEST2(*tptr, sizeof(struct in6_addr)))
-                   goto trunctlv;
+               ND_TCHECK2(*tptr, sizeof(struct in6_addr));

 
                 ND_PRINT((ndo, "\n\t      IPv6 interface address: %s",
                       ip6addr_string(ndo, tptr)));
 
                 ND_PRINT((ndo, "\n\t      IPv6 interface address: %s",
                       ip6addr_string(ndo, tptr)));


@@ -2646,8 +2634,7 @@ isis_print(netdissect_options *ndo,
            }
            break;
        case ISIS_TLV_AUTH:
            }
            break;
        case ISIS_TLV_AUTH:

-           if (!ND_TTEST2(*tptr, 1))
-               goto trunctlv;
+           ND_TCHECK2(*tptr, 1);

 
             ND_PRINT((ndo, "\n\t      %s: ",
                    tok2str(isis_subtlv_auth_values,
 
             ND_PRINT((ndo, "\n\t      %s: ",
                    tok2str(isis_subtlv_auth_values,


@@ -2656,27 +2643,20 @@ isis_print(netdissect_options *ndo,
 
            switch (*tptr) {
            case ISIS_SUBTLV_AUTH_SIMPLE:
 
            switch (*tptr) {
            case ISIS_SUBTLV_AUTH_SIMPLE:

-               for(i=1;i<tlv_len;i++) {
-                   if (!ND_TTEST2(*(tptr + i), 1))
-                       goto trunctlv;
-                   ND_PRINT((ndo, "%c", *(tptr + i)));
-               }
+               if (fn_printzp(ndo, tptr + 1, tlv_len - 1, ndo->ndo_snapend))
+                   goto trunctlv;

                break;
            case ISIS_SUBTLV_AUTH_MD5:
                for(i=1;i<tlv_len;i++) {
                break;
            case ISIS_SUBTLV_AUTH_MD5:
                for(i=1;i<tlv_len;i++) {

-                   if (!ND_TTEST2(*(tptr + i), 1))
-                       goto trunctlv;
+                   ND_TCHECK2(*(tptr + i), 1);

                    ND_PRINT((ndo, "%02x", *(tptr + i)));
                }
                if (tlv_len != ISIS_SUBTLV_AUTH_MD5_LEN+1)
                     ND_PRINT((ndo, ", (invalid subTLV) "));
 
                    ND_PRINT((ndo, "%02x", *(tptr + i)));
                }
                if (tlv_len != ISIS_SUBTLV_AUTH_MD5_LEN+1)
                     ND_PRINT((ndo, ", (invalid subTLV) "));
 

-#ifdef HAVE_LIBCRYPTO
-                sigcheck = signature_verify(ndo, optr, length,
-                                            (unsigned char *)tptr + 1);
-#else
-                sigcheck = CANT_CHECK_SIGNATURE;
-#endif
+                sigcheck = signature_verify(ndo, optr, length, tptr + 1,
+                                            isis_clear_checksum_lifetime,
+                                            header_lsp);

                 ND_PRINT((ndo, " (%s)", tok2str(signature_check_values, "Unknown", sigcheck)));
 
                break;
                 ND_PRINT((ndo, " (%s)", tok2str(signature_check_values, "Unknown", sigcheck)));
 
                break;


@@ -2685,8 +2665,7 @@ isis_print(netdissect_options *ndo,
                 key_id = EXTRACT_16BITS((tptr+1));
                 ND_PRINT((ndo, "%u, password: ", key_id));
                 for(i=1 + sizeof(uint16_t);i<tlv_len;i++) {
                 key_id = EXTRACT_16BITS((tptr+1));
                 ND_PRINT((ndo, "%u, password: ", key_id));
                 for(i=1 + sizeof(uint16_t);i<tlv_len;i++) {

-                    if (!ND_TTEST2(*(tptr + i), 1))
-                        goto trunctlv;
+                    ND_TCHECK2(*(tptr + i), 1);

                     ND_PRINT((ndo, "%02x", *(tptr + i)));
                 }
                 break;
                     ND_PRINT((ndo, "%02x", *(tptr + i)));
                 }
                 break;


@@ -2701,32 +2680,26 @@ isis_print(netdissect_options *ndo,
        case ISIS_TLV_PTP_ADJ:
            tlv_ptp_adj = (const struct isis_tlv_ptp_adj *)tptr;
            if(tmp>=1) {
        case ISIS_TLV_PTP_ADJ:
            tlv_ptp_adj = (const struct isis_tlv_ptp_adj *)tptr;
            if(tmp>=1) {

-               if (!ND_TTEST2(*tptr, 1))
-                   goto trunctlv;
+               ND_TCHECK2(*tptr, 1);

                ND_PRINT((ndo, "\n\t      Adjacency State: %s (%u)",
                       tok2str(isis_ptp_adjancey_values, "unknown", *tptr),
                         *tptr));
                tmp--;
            }
            if(tmp>sizeof(tlv_ptp_adj->extd_local_circuit_id)) {
                ND_PRINT((ndo, "\n\t      Adjacency State: %s (%u)",
                       tok2str(isis_ptp_adjancey_values, "unknown", *tptr),
                         *tptr));
                tmp--;
            }
            if(tmp>sizeof(tlv_ptp_adj->extd_local_circuit_id)) {

-               if (!ND_TTEST2(tlv_ptp_adj->extd_local_circuit_id,
-                            sizeof(tlv_ptp_adj->extd_local_circuit_id)))
-                   goto trunctlv;
+               ND_TCHECK(tlv_ptp_adj->extd_local_circuit_id);

                ND_PRINT((ndo, "\n\t      Extended Local circuit-ID: 0x%08x",
                       EXTRACT_32BITS(tlv_ptp_adj->extd_local_circuit_id)));
                tmp-=sizeof(tlv_ptp_adj->extd_local_circuit_id);
            }
            if(tmp>=SYSTEM_ID_LEN) {
                ND_PRINT((ndo, "\n\t      Extended Local circuit-ID: 0x%08x",
                       EXTRACT_32BITS(tlv_ptp_adj->extd_local_circuit_id)));
                tmp-=sizeof(tlv_ptp_adj->extd_local_circuit_id);
            }
            if(tmp>=SYSTEM_ID_LEN) {

-               if (!ND_TTEST2(tlv_ptp_adj->neighbor_sysid, SYSTEM_ID_LEN))
-                   goto trunctlv;
+               ND_TCHECK2(tlv_ptp_adj->neighbor_sysid, SYSTEM_ID_LEN);

                ND_PRINT((ndo, "\n\t      Neighbor System-ID: %s",
                       isis_print_id(tlv_ptp_adj->neighbor_sysid, SYSTEM_ID_LEN)));
                tmp-=SYSTEM_ID_LEN;
            }
            if(tmp>=sizeof(tlv_ptp_adj->neighbor_extd_local_circuit_id)) {
                ND_PRINT((ndo, "\n\t      Neighbor System-ID: %s",
                       isis_print_id(tlv_ptp_adj->neighbor_sysid, SYSTEM_ID_LEN)));
                tmp-=SYSTEM_ID_LEN;
            }
            if(tmp>=sizeof(tlv_ptp_adj->neighbor_extd_local_circuit_id)) {

-               if (!ND_TTEST2(tlv_ptp_adj->neighbor_extd_local_circuit_id,
-                            sizeof(tlv_ptp_adj->neighbor_extd_local_circuit_id)))
-                   goto trunctlv;
+               ND_TCHECK(tlv_ptp_adj->neighbor_extd_local_circuit_id);

                ND_PRINT((ndo, "\n\t      Neighbor Extended Local circuit-ID: 0x%08x",
                       EXTRACT_32BITS(tlv_ptp_adj->neighbor_extd_local_circuit_id)));
            }
                ND_PRINT((ndo, "\n\t      Neighbor Extended Local circuit-ID: 0x%08x",
                       EXTRACT_32BITS(tlv_ptp_adj->neighbor_extd_local_circuit_id)));
            }


@@ -2735,8 +2708,7 @@ isis_print(netdissect_options *ndo,
        case ISIS_TLV_PROTOCOLS:
            ND_PRINT((ndo, "\n\t      NLPID(s): "));
            while (tmp>0) {
        case ISIS_TLV_PROTOCOLS:
            ND_PRINT((ndo, "\n\t      NLPID(s): "));
            while (tmp>0) {

-               if (!ND_TTEST2(*(tptr), 1))
-                   goto trunctlv;
+               ND_TCHECK2(*(tptr), 1);

                ND_PRINT((ndo, "%s (0x%02x)",
                        tok2str(nlpid_values,
                                "unknown",
                ND_PRINT((ndo, "%s (0x%02x)",
                        tok2str(nlpid_values,
                                "unknown",


@@ -2751,8 +2723,7 @@ isis_print(netdissect_options *ndo,
 
     case ISIS_TLV_MT_PORT_CAP:
     {
 
     case ISIS_TLV_MT_PORT_CAP:
     {

-      if (!ND_TTEST2(*(tptr), 2))
-        goto trunctlv;
+      ND_TCHECK2(*(tptr), 2);

 
       ND_PRINT((ndo, "\n\t       RES: %d, MTID(s): %d",
               (EXTRACT_16BITS (tptr) >> 12),
 
       ND_PRINT((ndo, "\n\t       RES: %d, MTID(s): %d",
               (EXTRACT_16BITS (tptr) >> 12),


@@ -2769,8 +2740,7 @@ isis_print(netdissect_options *ndo,
 
     case ISIS_TLV_MT_CAPABILITY:
 
 
     case ISIS_TLV_MT_CAPABILITY:
 

-      if (!ND_TTEST2(*(tptr), 2))
-        goto trunctlv;
+      ND_TCHECK2(*(tptr), 2);

 
       ND_PRINT((ndo, "\n\t      O: %d, RES: %d, MTID(s): %d",
                 (EXTRACT_16BITS(tptr) >> 15) & 0x01,
 
       ND_PRINT((ndo, "\n\t      O: %d, RES: %d, MTID(s): %d",
                 (EXTRACT_16BITS(tptr) >> 15) & 0x01,


@@ -2786,15 +2756,13 @@ isis_print(netdissect_options *ndo,
       break;
 
        case ISIS_TLV_TE_ROUTER_ID:
       break;
 
        case ISIS_TLV_TE_ROUTER_ID:

-           if (!ND_TTEST2(*pptr, sizeof(struct in_addr)))
-               goto trunctlv;
+           ND_TCHECK2(*pptr, sizeof(struct in_addr));

            ND_PRINT((ndo, "\n\t      Traffic Engineering Router ID: %s", ipaddr_string(ndo, pptr)));
            break;
 
        case ISIS_TLV_IPADDR:
            while (tmp>=sizeof(struct in_addr)) {
            ND_PRINT((ndo, "\n\t      Traffic Engineering Router ID: %s", ipaddr_string(ndo, pptr)));
            break;
 
        case ISIS_TLV_IPADDR:
            while (tmp>=sizeof(struct in_addr)) {

-               if (!ND_TTEST2(*tptr, sizeof(struct in_addr)))
-                   goto trunctlv;
+               ND_TCHECK2(*tptr, sizeof(struct in_addr));

                ND_PRINT((ndo, "\n\t      IPv4 interface address: %s", ipaddr_string(ndo, tptr)));
                tptr += sizeof(struct in_addr);
                tmp -= sizeof(struct in_addr);
                ND_PRINT((ndo, "\n\t      IPv4 interface address: %s", ipaddr_string(ndo, tptr)));
                tptr += sizeof(struct in_addr);
                tmp -= sizeof(struct in_addr);


@@ -2803,49 +2771,40 @@ isis_print(netdissect_options *ndo,
 
        case ISIS_TLV_HOSTNAME:
            ND_PRINT((ndo, "\n\t      Hostname: "));
 
        case ISIS_TLV_HOSTNAME:
            ND_PRINT((ndo, "\n\t      Hostname: "));

-           while (tmp>0) {
-               if (!ND_TTEST2(*tptr, 1))
-                   goto trunctlv;
-               ND_PRINT((ndo, "%c", *tptr++));
-                tmp--;
-           }
+           if (fn_printzp(ndo, tptr, tmp, ndo->ndo_snapend))
+               goto trunctlv;

            break;
 
        case ISIS_TLV_SHARED_RISK_GROUP:
            if (tmp < NODE_ID_LEN)
                break;
            break;
 
        case ISIS_TLV_SHARED_RISK_GROUP:
            if (tmp < NODE_ID_LEN)
                break;

-           if (!ND_TTEST2(*tptr, NODE_ID_LEN))
-                goto trunctlv;
+           ND_TCHECK2(*tptr, NODE_ID_LEN);

            ND_PRINT((ndo, "\n\t      IS Neighbor: %s", isis_print_id(tptr, NODE_ID_LEN)));
            tptr+=(NODE_ID_LEN);
            tmp-=(NODE_ID_LEN);
 
            if (tmp < 1)
                break;
            ND_PRINT((ndo, "\n\t      IS Neighbor: %s", isis_print_id(tptr, NODE_ID_LEN)));
            tptr+=(NODE_ID_LEN);
            tmp-=(NODE_ID_LEN);
 
            if (tmp < 1)
                break;

-           if (!ND_TTEST2(*tptr, 1))
-                goto trunctlv;
+           ND_TCHECK2(*tptr, 1);

            ND_PRINT((ndo, ", Flags: [%s]", ISIS_MASK_TLV_SHARED_RISK_GROUP(*tptr++) ? "numbered" : "unnumbered"));
            tmp--;
 
            if (tmp < sizeof(struct in_addr))
                break;
            ND_PRINT((ndo, ", Flags: [%s]", ISIS_MASK_TLV_SHARED_RISK_GROUP(*tptr++) ? "numbered" : "unnumbered"));
            tmp--;
 
            if (tmp < sizeof(struct in_addr))
                break;

-           if (!ND_TTEST2(*tptr, sizeof(struct in_addr)))
-                goto trunctlv;
+           ND_TCHECK2(*tptr, sizeof(struct in_addr));

            ND_PRINT((ndo, "\n\t      IPv4 interface address: %s", ipaddr_string(ndo, tptr)));
            tptr+=sizeof(struct in_addr);
            tmp-=sizeof(struct in_addr);
 
            if (tmp < sizeof(struct in_addr))
                break;
            ND_PRINT((ndo, "\n\t      IPv4 interface address: %s", ipaddr_string(ndo, tptr)));
            tptr+=sizeof(struct in_addr);
            tmp-=sizeof(struct in_addr);
 
            if (tmp < sizeof(struct in_addr))
                break;

-           if (!ND_TTEST2(*tptr, sizeof(struct in_addr)))
-                goto trunctlv;
+           ND_TCHECK2(*tptr, sizeof(struct in_addr));

            ND_PRINT((ndo, "\n\t      IPv4 neighbor address: %s", ipaddr_string(ndo, tptr)));
            tptr+=sizeof(struct in_addr);
            tmp-=sizeof(struct in_addr);
 
            while (tmp>=4) {
            ND_PRINT((ndo, "\n\t      IPv4 neighbor address: %s", ipaddr_string(ndo, tptr)));
            tptr+=sizeof(struct in_addr);
            tmp-=sizeof(struct in_addr);
 
            while (tmp>=4) {

-                if (!ND_TTEST2(*tptr, 4))
-                    goto trunctlv;
+                ND_TCHECK2(*tptr, 4);

                 ND_PRINT((ndo, "\n\t      Link-ID: 0x%08x", EXTRACT_32BITS(tptr)));
                 tptr+=4;
                 tmp-=4;
                 ND_PRINT((ndo, "\n\t      Link-ID: 0x%08x", EXTRACT_32BITS(tptr)));
                 tptr+=4;
                 tmp-=4;


@@ -2855,18 +2814,14 @@ isis_print(netdissect_options *ndo,
        case ISIS_TLV_LSP:
            tlv_lsp = (const struct isis_tlv_lsp *)tptr;
            while(tmp>=sizeof(struct isis_tlv_lsp)) {
        case ISIS_TLV_LSP:
            tlv_lsp = (const struct isis_tlv_lsp *)tptr;
            while(tmp>=sizeof(struct isis_tlv_lsp)) {

-               if (!ND_TTEST((tlv_lsp->lsp_id)[LSP_ID_LEN-1]))
-                   goto trunctlv;
+               ND_TCHECK((tlv_lsp->lsp_id)[LSP_ID_LEN-1]);

                ND_PRINT((ndo, "\n\t      lsp-id: %s",
                        isis_print_id(tlv_lsp->lsp_id, LSP_ID_LEN)));
                ND_PRINT((ndo, "\n\t      lsp-id: %s",
                        isis_print_id(tlv_lsp->lsp_id, LSP_ID_LEN)));

-               if (!ND_TTEST2(tlv_lsp->sequence_number, 4))
-                   goto trunctlv;
+               ND_TCHECK2(tlv_lsp->sequence_number, 4);

                ND_PRINT((ndo, ", seq: 0x%08x", EXTRACT_32BITS(tlv_lsp->sequence_number)));
                ND_PRINT((ndo, ", seq: 0x%08x", EXTRACT_32BITS(tlv_lsp->sequence_number)));

-               if (!ND_TTEST2(tlv_lsp->remaining_lifetime, 2))
-                   goto trunctlv;
+               ND_TCHECK2(tlv_lsp->remaining_lifetime, 2);

                ND_PRINT((ndo, ", lifetime: %5ds", EXTRACT_16BITS(tlv_lsp->remaining_lifetime)));
                ND_PRINT((ndo, ", lifetime: %5ds", EXTRACT_16BITS(tlv_lsp->remaining_lifetime)));

-               if (!ND_TTEST2(tlv_lsp->checksum, 2))
-                   goto trunctlv;
+               ND_TCHECK2(tlv_lsp->checksum, 2);

                ND_PRINT((ndo, ", chksum: 0x%04x", EXTRACT_16BITS(tlv_lsp->checksum)));
                tmp-=sizeof(struct isis_tlv_lsp);
                tlv_lsp++;
                ND_PRINT((ndo, ", chksum: 0x%04x", EXTRACT_16BITS(tlv_lsp->checksum)));
                tmp-=sizeof(struct isis_tlv_lsp);
                tlv_lsp++;


@@ -2876,8 +2831,7 @@ isis_print(netdissect_options *ndo,
        case ISIS_TLV_CHECKSUM:
            if (tmp < ISIS_TLV_CHECKSUM_MINLEN)
                break;
        case ISIS_TLV_CHECKSUM:
            if (tmp < ISIS_TLV_CHECKSUM_MINLEN)
                break;

-           if (!ND_TTEST2(*tptr, ISIS_TLV_CHECKSUM_MINLEN))
-               goto trunctlv;
+           ND_TCHECK2(*tptr, ISIS_TLV_CHECKSUM_MINLEN);

            ND_PRINT((ndo, "\n\t      checksum: 0x%04x ", EXTRACT_16BITS(tptr)));
             /* do not attempt to verify the checksum if it is zero
              * most likely a HMAC-MD5 TLV is also present and
            ND_PRINT((ndo, "\n\t      checksum: 0x%04x ", EXTRACT_16BITS(tptr)));
             /* do not attempt to verify the checksum if it is zero
              * most likely a HMAC-MD5 TLV is also present and


@@ -2891,15 +2845,13 @@ isis_print(netdissect_options *ndo,
 
        case ISIS_TLV_POI:
            if (tlv_len >= SYSTEM_ID_LEN + 1) {
 
        case ISIS_TLV_POI:
            if (tlv_len >= SYSTEM_ID_LEN + 1) {

-               if (!ND_TTEST2(*tptr, SYSTEM_ID_LEN + 1))
-                   goto trunctlv;
+               ND_TCHECK2(*tptr, SYSTEM_ID_LEN + 1);

                ND_PRINT((ndo, "\n\t      Purge Originator System-ID: %s",
                       isis_print_id(tptr + 1, SYSTEM_ID_LEN)));
            }
 
            if (tlv_len == 2 * SYSTEM_ID_LEN + 1) {
                ND_PRINT((ndo, "\n\t      Purge Originator System-ID: %s",
                       isis_print_id(tptr + 1, SYSTEM_ID_LEN)));
            }
 
            if (tlv_len == 2 * SYSTEM_ID_LEN + 1) {

-               if (!ND_TTEST2(*tptr, 2 * SYSTEM_ID_LEN + 1))
-                   goto trunctlv;
+               ND_TCHECK2(*tptr, 2 * SYSTEM_ID_LEN + 1);

                ND_PRINT((ndo, "\n\t      Received from System-ID: %s",
                       isis_print_id(tptr + SYSTEM_ID_LEN + 1, SYSTEM_ID_LEN)));
            }
                ND_PRINT((ndo, "\n\t      Received from System-ID: %s",
                       isis_print_id(tptr + SYSTEM_ID_LEN + 1, SYSTEM_ID_LEN)));
            }


@@ -2928,8 +2880,7 @@ isis_print(netdissect_options *ndo,
             /* first attempt to decode the flags */
             if (tmp < ISIS_TLV_RESTART_SIGNALING_FLAGLEN)
                 break;
             /* first attempt to decode the flags */
             if (tmp < ISIS_TLV_RESTART_SIGNALING_FLAGLEN)
                 break;

-            if (!ND_TTEST2(*tptr, ISIS_TLV_RESTART_SIGNALING_FLAGLEN))
-                goto trunctlv;
+            ND_TCHECK2(*tptr, ISIS_TLV_RESTART_SIGNALING_FLAGLEN);

             ND_PRINT((ndo, "\n\t      Flags [%s]",
                    bittok2str(isis_restart_flag_values, "none", *tptr)));
             tptr+=ISIS_TLV_RESTART_SIGNALING_FLAGLEN;
             ND_PRINT((ndo, "\n\t      Flags [%s]",
                    bittok2str(isis_restart_flag_values, "none", *tptr)));
             tptr+=ISIS_TLV_RESTART_SIGNALING_FLAGLEN;


@@ -2941,8 +2892,7 @@ isis_print(netdissect_options *ndo,
 
             if (tmp < ISIS_TLV_RESTART_SIGNALING_HOLDTIMELEN)
                 break;
 
             if (tmp < ISIS_TLV_RESTART_SIGNALING_HOLDTIMELEN)
                 break;

-            if (!ND_TTEST2(*tptr, ISIS_TLV_RESTART_SIGNALING_HOLDTIMELEN))
-                goto trunctlv;
+            ND_TCHECK2(*tptr, ISIS_TLV_RESTART_SIGNALING_HOLDTIMELEN);

 
             ND_PRINT((ndo, ", Remaining holding time %us", EXTRACT_16BITS(tptr)));
             tptr+=ISIS_TLV_RESTART_SIGNALING_HOLDTIMELEN;
 
             ND_PRINT((ndo, ", Remaining holding time %us", EXTRACT_16BITS(tptr)));
             tptr+=ISIS_TLV_RESTART_SIGNALING_HOLDTIMELEN;


@@ -2950,8 +2900,7 @@ isis_print(netdissect_options *ndo,
 
             /* is there an additional sysid field present ?*/
             if (tmp == SYSTEM_ID_LEN) {
 
             /* is there an additional sysid field present ?*/
             if (tmp == SYSTEM_ID_LEN) {

-                    if (!ND_TTEST2(*tptr, SYSTEM_ID_LEN))
-                            goto trunctlv;
+                    ND_TCHECK2(*tptr, SYSTEM_ID_LEN);

                     ND_PRINT((ndo, ", for %s", isis_print_id(tptr,SYSTEM_ID_LEN)));
             }
            break;
                     ND_PRINT((ndo, ", for %s", isis_print_id(tptr,SYSTEM_ID_LEN)));
             }
            break;


@@ -2959,16 +2908,14 @@ isis_print(netdissect_options *ndo,
         case ISIS_TLV_IDRP_INFO:
            if (tmp < ISIS_TLV_IDRP_INFO_MINLEN)
                break;
         case ISIS_TLV_IDRP_INFO:
            if (tmp < ISIS_TLV_IDRP_INFO_MINLEN)
                break;

-            if (!ND_TTEST2(*tptr, ISIS_TLV_IDRP_INFO_MINLEN))
-                goto trunctlv;
+            ND_TCHECK2(*tptr, ISIS_TLV_IDRP_INFO_MINLEN);

             ND_PRINT((ndo, "\n\t      Inter-Domain Information Type: %s",
                    tok2str(isis_subtlv_idrp_values,
                            "Unknown (0x%02x)",
                            *tptr)));
             switch (*tptr++) {
             case ISIS_SUBTLV_IDRP_ASN:
             ND_PRINT((ndo, "\n\t      Inter-Domain Information Type: %s",
                    tok2str(isis_subtlv_idrp_values,
                            "Unknown (0x%02x)",
                            *tptr)));
             switch (*tptr++) {
             case ISIS_SUBTLV_IDRP_ASN:

-                if (!ND_TTEST2(*tptr, 2)) /* fetch AS number */
-                    goto trunctlv;
+                ND_TCHECK2(*tptr, 2); /* fetch AS number */

                 ND_PRINT((ndo, "AS Number: %u", EXTRACT_16BITS(tptr)));
                 break;
             case ISIS_SUBTLV_IDRP_LOCAL:
                 ND_PRINT((ndo, "AS Number: %u", EXTRACT_16BITS(tptr)));
                 break;
             case ISIS_SUBTLV_IDRP_LOCAL:


@@ -2983,15 +2930,13 @@ isis_print(netdissect_options *ndo,
         case ISIS_TLV_LSP_BUFFERSIZE:
            if (tmp < ISIS_TLV_LSP_BUFFERSIZE_MINLEN)
                break;
         case ISIS_TLV_LSP_BUFFERSIZE:
            if (tmp < ISIS_TLV_LSP_BUFFERSIZE_MINLEN)
                break;

-            if (!ND_TTEST2(*tptr, ISIS_TLV_LSP_BUFFERSIZE_MINLEN))
-                goto trunctlv;
+            ND_TCHECK2(*tptr, ISIS_TLV_LSP_BUFFERSIZE_MINLEN);

             ND_PRINT((ndo, "\n\t      LSP Buffersize: %u", EXTRACT_16BITS(tptr)));
             break;
 
         case ISIS_TLV_PART_DIS:
             while (tmp >= SYSTEM_ID_LEN) {
             ND_PRINT((ndo, "\n\t      LSP Buffersize: %u", EXTRACT_16BITS(tptr)));
             break;
 
         case ISIS_TLV_PART_DIS:
             while (tmp >= SYSTEM_ID_LEN) {

-                if (!ND_TTEST2(*tptr, SYSTEM_ID_LEN))
-                    goto trunctlv;
+                ND_TCHECK2(*tptr, SYSTEM_ID_LEN);

                 ND_PRINT((ndo, "\n\t      %s", isis_print_id(tptr, SYSTEM_ID_LEN)));
                 tptr+=SYSTEM_ID_LEN;
                 tmp-=SYSTEM_ID_LEN;
                 ND_PRINT((ndo, "\n\t      %s", isis_print_id(tptr, SYSTEM_ID_LEN)));
                 tptr+=SYSTEM_ID_LEN;
                 tmp-=SYSTEM_ID_LEN;


@@ -3001,16 +2946,14 @@ isis_print(netdissect_options *ndo,
         case ISIS_TLV_PREFIX_NEIGH:
            if (tmp < sizeof(struct isis_metric_block))
                break;
         case ISIS_TLV_PREFIX_NEIGH:
            if (tmp < sizeof(struct isis_metric_block))
                break;

-            if (!ND_TTEST2(*tptr, sizeof(struct isis_metric_block)))
-                goto trunctlv;
+            ND_TCHECK2(*tptr, sizeof(struct isis_metric_block));

             ND_PRINT((ndo, "\n\t      Metric Block"));
             isis_print_metric_block(ndo, (const struct isis_metric_block *)tptr);
             tptr+=sizeof(struct isis_metric_block);
             tmp-=sizeof(struct isis_metric_block);
 
             while(tmp>0) {
             ND_PRINT((ndo, "\n\t      Metric Block"));
             isis_print_metric_block(ndo, (const struct isis_metric_block *)tptr);
             tptr+=sizeof(struct isis_metric_block);
             tmp-=sizeof(struct isis_metric_block);
 
             while(tmp>0) {

-                if (!ND_TTEST2(*tptr, 1))
-                    goto trunctlv;
+                ND_TCHECK2(*tptr, 1);

                 prefix_len=*tptr++; /* read out prefix length in semioctets*/
                 if (prefix_len < 2) {
                     ND_PRINT((ndo, "\n\t\tAddress: prefix length %u < 2", prefix_len));
                 prefix_len=*tptr++; /* read out prefix length in semioctets*/
                 if (prefix_len < 2) {
                     ND_PRINT((ndo, "\n\t\tAddress: prefix length %u < 2", prefix_len));


@@ -3019,8 +2962,7 @@ isis_print(netdissect_options *ndo,
                 tmp--;
                 if (tmp < prefix_len/2)
                     break;
                 tmp--;
                 if (tmp < prefix_len/2)
                     break;

-                if (!ND_TTEST2(*tptr, prefix_len / 2))
-                    goto trunctlv;
+                ND_TCHECK2(*tptr, prefix_len / 2);

                 ND_PRINT((ndo, "\n\t\tAddress: %s/%u",
                        isonsap_string(ndo, tptr, prefix_len / 2), prefix_len * 4));
                 tptr+=prefix_len/2;
                 ND_PRINT((ndo, "\n\t\tAddress: %s/%u",
                        isonsap_string(ndo, tptr, prefix_len / 2), prefix_len * 4));
                 tptr+=prefix_len/2;


@@ -3031,16 +2973,14 @@ isis_print(netdissect_options *ndo,
         case ISIS_TLV_IIH_SEQNR:
            if (tmp < ISIS_TLV_IIH_SEQNR_MINLEN)
                break;
         case ISIS_TLV_IIH_SEQNR:
            if (tmp < ISIS_TLV_IIH_SEQNR_MINLEN)
                break;

-            if (!ND_TTEST2(*tptr, ISIS_TLV_IIH_SEQNR_MINLEN)) /* check if four bytes are on the wire */
-                goto trunctlv;
+            ND_TCHECK2(*tptr, ISIS_TLV_IIH_SEQNR_MINLEN); /* check if four bytes are on the wire */

             ND_PRINT((ndo, "\n\t      Sequence number: %u", EXTRACT_32BITS(tptr)));
             break;
 
         case ISIS_TLV_VENDOR_PRIVATE:
            if (tmp < ISIS_TLV_VENDOR_PRIVATE_MINLEN)
                break;
             ND_PRINT((ndo, "\n\t      Sequence number: %u", EXTRACT_32BITS(tptr)));
             break;
 
         case ISIS_TLV_VENDOR_PRIVATE:
            if (tmp < ISIS_TLV_VENDOR_PRIVATE_MINLEN)
                break;

-            if (!ND_TTEST2(*tptr, ISIS_TLV_VENDOR_PRIVATE_MINLEN)) /* check if enough byte for a full oui */
-                goto trunctlv;
+            ND_TCHECK2(*tptr, ISIS_TLV_VENDOR_PRIVATE_MINLEN); /* check if enough byte for a full oui */

             vendor_id = EXTRACT_24BITS(tptr);
             ND_PRINT((ndo, "\n\t      Vendor: %s (%u)",
                    tok2str(oui_values, "Unknown", vendor_id),
             vendor_id = EXTRACT_24BITS(tptr);
             ND_PRINT((ndo, "\n\t      Vendor: %s (%u)",
                    tok2str(oui_values, "Unknown", vendor_id),