CVE-2017-12897/ISO CLNS: Use ND_TTEST() for the bounds checks in isoclns_print().

[tcpdump] / print-mpls.c

diff --git a/print-mpls.c b/print-mpls.c
index cd323ce26c44667170ad02fcdaaf8a60bd0d78fc..5c26e4f9b2a1a48c8d3555113766e5e165cddb4f 100644 (file)
--- a/print-mpls.c
+++ b/print-mpls.c
@@ -26,14 +26,16 @@
  * SUCH DAMAGE.
  */
 
+/* \summary: Multi-Protocol Label Switching (MPLS) printer */
+
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
 
-#include <tcpdump-stdinc.h>
+#include <netdissect-stdinc.h>
 
-#include "interface.h"
-#include "extract.h"                   /* must come after interface.h */
+#include "netdissect.h"
+#include "extract.h"
 #include "mpls.h"
 
 static const char *mpls_labelname[] = {
@@ -58,14 +60,18 @@ void
 mpls_print(netdissect_options *ndo, const u_char *bp, u_int length)
 {
        const u_char *p;
-       u_int32_t label_entry;
-       u_int16_t label_stack_depth = 0;
+       uint32_t label_entry;
+       uint16_t label_stack_depth = 0;
        enum mpls_packet_type pt = PT_UNKNOWN;
 
        p = bp;
        ND_PRINT((ndo, "MPLS"));
        do {
                ND_TCHECK2(*p, sizeof(label_entry));
+               if (length < sizeof(label_entry)) {
+                       ND_PRINT((ndo, "[|MPLS], length %u", length));
+                       return;
+               }
                label_entry = EXTRACT_32BITS(p);
                ND_PRINT((ndo, "%s(label %u",
                       (label_stack_depth && ndo->ndo_vflag) ? "\n\t" : " ",
@@ -80,6 +86,7 @@ mpls_print(netdissect_options *ndo, const u_char *bp, u_int length)
                ND_PRINT((ndo, ", ttl %u)", MPLS_TTL(label_entry)));
 
                p += sizeof(label_entry);
+               length -= sizeof(label_entry);
        } while (!MPLS_STACK(label_entry));
 
        /*
@@ -122,6 +129,11 @@ mpls_print(netdissect_options *ndo, const u_char *bp, u_int length)
                 * Cisco sends control-plane traffic MPLS-encapsulated in
                 * this fashion.
                 */
+               ND_TCHECK(*p);
+               if (length < 1) {
+                       /* nothing to print */
+                       return;
+               }
                switch(*p) {
 
                case 0x45:
@@ -174,26 +186,22 @@ mpls_print(netdissect_options *ndo, const u_char *bp, u_int length)
         */
        if (pt == PT_UNKNOWN) {
                if (!ndo->ndo_suppress_default_print)
-                       ndo->ndo_default_print(ndo, p, length - (p - bp));
+                       ND_DEFAULTPRINT(p, length);
                return;
        }
        ND_PRINT((ndo, ndo->ndo_vflag ? "\n\t" : " "));
        switch (pt) {
 
        case PT_IPV4:
-               ip_print(ndo, p, length - (p - bp));
+               ip_print(ndo, p, length);
                break;
 
        case PT_IPV6:
-#ifdef INET6
-               ip6_print(ndo, p, length - (p - bp));
-#else
-               ND_PRINT((ndo, "IPv6, length: %u", length));
-#endif
+               ip6_print(ndo, p, length);
                break;
 
        case PT_OSI:
-               isoclns_print(p, length - (p - bp), length - (p - bp));
+               isoclns_print(ndo, p, length);
                break;
 
        default: