- subobj_len = EXTRACT_16BITS(obj_tptr);
- subobj_type = (EXTRACT_16BITS(obj_tptr+2))>>8;
- af = (EXTRACT_16BITS(obj_tptr+2))&0x00FF;
-
- printf("%s Subobject Type: %s (%u), AF: %s (%u), length: %u",
- ident,
+ /* If RFC 3476 Section 3.1 defined that a sub-object of the
+ * GENERALIZED_UNI RSVP object must have the Length field as
+ * a multiple of 4, instead of the check below it would be
+ * better to test total_subobj_len only once before the loop.
+ * So long as it does not define it and this while loop does
+ * not implement such a requirement, let's accept that within
+ * each iteration subobj_len may happen to be a multiple of 1
+ * and test it and total_subobj_len respectively.
+ */
+ if (total_subobj_len < 4)
+ goto invalid;
+ subobj_len = EXTRACT_BE_U_2(obj_tptr);
+ subobj_type = (EXTRACT_BE_U_2(obj_tptr + 2))>>8;
+ af = (EXTRACT_BE_U_2(obj_tptr + 2))&0x00FF;
+
+ ND_PRINT((ndo, "%s Subobject Type: %s (%u), AF: %s (%u), length: %u",
+ indent,