CVE-2017-13029/PPP: Fix a bounds check, and clean up other bounds checks.

[tcpdump] / print-pim.c

diff --git a/print-pim.c b/print-pim.c
index 255259537494b3db0800f15b7980ede4f0aa2f74..ee18d958132e84d3b5e0f5afebc59fac63eb423e 100644 (file)
--- a/print-pim.c
+++ b/print-pim.c
@@ -306,6 +306,7 @@ pimv1_print(netdissect_options *ndo,
                        pimv1_join_prune_print(ndo, &bp[8], len - 8);
                break;
        }
+       ND_TCHECK(bp[4]);
        if ((bp[4] >> 4) != 1)
                ND_PRINT((ndo, " [v%d]", bp[4] >> 4));
        return;
@@ -729,7 +730,11 @@ pimv2_print(netdissect_options *ndo,
 
                        switch (otype) {
                        case PIMV2_HELLO_OPTION_HOLDTIME:
-                               unsigned_relts_print(ndo, EXTRACT_16BITS(bp));
+                               if (olen != 2) {
+                                       ND_PRINT((ndo, "ERROR: Option Length != 2 Bytes (%u)", olen));
+                               } else {
+                                       unsigned_relts_print(ndo, EXTRACT_16BITS(bp));
+                               }
                                break;
 
                        case PIMV2_HELLO_OPTION_LANPRUNEDELAY:
@@ -763,17 +768,25 @@ pimv2_print(netdissect_options *ndo,
                                break;
 
                        case PIMV2_HELLO_OPTION_GENID:
-                               ND_PRINT((ndo, "0x%08x", EXTRACT_32BITS(bp)));
+                               if (olen != 4) {
+                                       ND_PRINT((ndo, "ERROR: Option Length != 4 Bytes (%u)", olen));
+                               } else {
+                                       ND_PRINT((ndo, "0x%08x", EXTRACT_32BITS(bp)));
+                               }
                                break;
 
                        case PIMV2_HELLO_OPTION_REFRESH_CAP:
-                               ND_PRINT((ndo, "v%d", *bp));
-                               if (*(bp+1) != 0) {
-                                       ND_PRINT((ndo, ", interval "));
-                                       unsigned_relts_print(ndo, *(bp+1));
-                               }
-                               if (EXTRACT_16BITS(bp+2) != 0) {
-                                       ND_PRINT((ndo, " ?0x%04x?", EXTRACT_16BITS(bp+2)));
+                               if (olen != 4) {
+                                       ND_PRINT((ndo, "ERROR: Option Length != 4 Bytes (%u)", olen));
+                               } else {
+                                       ND_PRINT((ndo, "v%d", *bp));
+                                       if (*(bp+1) != 0) {
+                                               ND_PRINT((ndo, ", interval "));
+                                               unsigned_relts_print(ndo, *(bp+1));
+                                       }
+                                       if (EXTRACT_16BITS(bp+2) != 0) {
+                                               ND_PRINT((ndo, " ?0x%04x?", EXTRACT_16BITS(bp+2)));
+                                       }
                                }
                                break;