CVE-2017-13029/PPP: Fix a bounds check, and clean up other bounds checks.

[tcpdump] / print-pim.c

diff --git a/print-pim.c b/print-pim.c
index 092c41fe196397ff2759ddb57dc5889adabd6b95..ee18d958132e84d3b5e0f5afebc59fac63eb423e 100644 (file)
--- a/print-pim.c
+++ b/print-pim.c
@@ -155,7 +155,7 @@ pimv1_join_prune_print(netdissect_options *ndo,
                hold = EXTRACT_16BITS(&bp[6]);
                if (hold != 180) {
                        ND_PRINT((ndo, "Hold "));
-                       relts_print(ndo, hold);
+                       unsigned_relts_print(ndo, hold);
                }
                ND_PRINT((ndo, "%s (%s/%d, %s", njoin ? "Join" : "Prune",
                ipaddr_string(ndo, &bp[26]), bp[25] & 0x3f,
@@ -177,7 +177,7 @@ pimv1_join_prune_print(netdissect_options *ndo,
        if (ndo->ndo_vflag > 1)
                ND_PRINT((ndo, "\n"));
        ND_PRINT((ndo, " Hold time: "));
-       relts_print(ndo, EXTRACT_16BITS(&bp[6]));
+       unsigned_relts_print(ndo, EXTRACT_16BITS(&bp[6]));
        if (ndo->ndo_vflag < 2)
                return;
        bp += 8;
@@ -262,7 +262,7 @@ pimv1_print(netdissect_options *ndo,
                if (ndo->ndo_vflag) {
                        ND_TCHECK2(bp[10],2);
                        ND_PRINT((ndo, " (Hold-time "));
-                       relts_print(ndo, EXTRACT_16BITS(&bp[10]));
+                       unsigned_relts_print(ndo, EXTRACT_16BITS(&bp[10]));
                        ND_PRINT((ndo, ")"));
                }
                break;
@@ -284,7 +284,7 @@ pimv1_print(netdissect_options *ndo,
                        if (EXTRACT_32BITS(&bp[12]) != 0xffffffff)
                                ND_PRINT((ndo, "/%s", ipaddr_string(ndo, &bp[12])));
                        ND_PRINT((ndo, " RP %s hold ", ipaddr_string(ndo, &bp[16])));
-                       relts_print(ndo, EXTRACT_16BITS(&bp[22]));
+                       unsigned_relts_print(ndo, EXTRACT_16BITS(&bp[22]));
                }
                break;
        case PIMV1_TYPE_ASSERT:
@@ -306,6 +306,7 @@ pimv1_print(netdissect_options *ndo,
                        pimv1_join_prune_print(ndo, &bp[8], len - 8);
                break;
        }
+       ND_TCHECK(bp[4]);
        if ((bp[4] >> 4) != 1)
                ND_PRINT((ndo, " [v%d]", bp[4] >> 4));
        return;
@@ -351,7 +352,7 @@ cisco_autorp_print(netdissect_options *ndo,
        ND_PRINT((ndo, " Hold "));
        hold = EXTRACT_16BITS(&bp[2]);
        if (hold)
-               relts_print(ndo, EXTRACT_16BITS(&bp[2]));
+               unsigned_relts_print(ndo, EXTRACT_16BITS(&bp[2]));
        else
                ND_PRINT((ndo, "FOREVER"));
 
@@ -729,7 +730,11 @@ pimv2_print(netdissect_options *ndo,
 
                        switch (otype) {
                        case PIMV2_HELLO_OPTION_HOLDTIME:
-                               relts_print(ndo, EXTRACT_16BITS(bp));
+                               if (olen != 2) {
+                                       ND_PRINT((ndo, "ERROR: Option Length != 2 Bytes (%u)", olen));
+                               } else {
+                                       unsigned_relts_print(ndo, EXTRACT_16BITS(bp));
+                               }
                                break;
 
                        case PIMV2_HELLO_OPTION_LANPRUNEDELAY:
@@ -763,17 +768,25 @@ pimv2_print(netdissect_options *ndo,
                                break;
 
                        case PIMV2_HELLO_OPTION_GENID:
-                               ND_PRINT((ndo, "0x%08x", EXTRACT_32BITS(bp)));
+                               if (olen != 4) {
+                                       ND_PRINT((ndo, "ERROR: Option Length != 4 Bytes (%u)", olen));
+                               } else {
+                                       ND_PRINT((ndo, "0x%08x", EXTRACT_32BITS(bp)));
+                               }
                                break;
 
                        case PIMV2_HELLO_OPTION_REFRESH_CAP:
-                               ND_PRINT((ndo, "v%d", *bp));
-                               if (*(bp+1) != 0) {
-                                       ND_PRINT((ndo, ", interval "));
-                                       relts_print(ndo, *(bp+1));
-                               }
-                               if (EXTRACT_16BITS(bp+2) != 0) {
-                                       ND_PRINT((ndo, " ?0x%04x?", EXTRACT_16BITS(bp+2)));
+                               if (olen != 4) {
+                                       ND_PRINT((ndo, "ERROR: Option Length != 4 Bytes (%u)", olen));
+                               } else {
+                                       ND_PRINT((ndo, "v%d", *bp));
+                                       if (*(bp+1) != 0) {
+                                               ND_PRINT((ndo, ", interval "));
+                                               unsigned_relts_print(ndo, *(bp+1));
+                                       }
+                                       if (EXTRACT_16BITS(bp+2) != 0) {
+                                               ND_PRINT((ndo, " ?0x%04x?", EXTRACT_16BITS(bp+2)));
+                                       }
                                }
                                break;
 
@@ -932,7 +945,7 @@ pimv2_print(netdissect_options *ndo,
                        if (holdtime == 0xffff)
                                ND_PRINT((ndo, "infinite"));
                        else
-                               relts_print(ndo, holdtime);
+                               unsigned_relts_print(ndo, holdtime);
                }
                bp += 4; len -= 4;
                for (i = 0; i < ngroup; i++) {
@@ -1036,7 +1049,7 @@ pimv2_print(netdissect_options *ndo,
                                        goto bs_done;
                                }
                                ND_PRINT((ndo, ",holdtime="));
-                               relts_print(ndo, EXTRACT_16BITS(bp));
+                               unsigned_relts_print(ndo, EXTRACT_16BITS(bp));
                                if (bp + 2 >= ep) {
                                        ND_PRINT((ndo, "...)"));
                                        goto bs_done;
@@ -1088,7 +1101,7 @@ pimv2_print(netdissect_options *ndo,
                ND_PRINT((ndo, " prio=%d", bp[1]));
                if (bp + 3 >= ep) break;
                ND_PRINT((ndo, " holdtime="));
-               relts_print(ndo, EXTRACT_16BITS(&bp[2]));
+               unsigned_relts_print(ndo, EXTRACT_16BITS(&bp[2]));
                bp += 4;
 
                /* Encoded-Unicast-RP-Address */
@@ -1134,7 +1147,7 @@ pimv2_print(netdissect_options *ndo,
                bp += advance;
                ND_TCHECK2(bp[0], 2);
                ND_PRINT((ndo, " TUNR "));
-               relts_print(ndo, EXTRACT_16BITS(bp));
+               unsigned_relts_print(ndo, EXTRACT_16BITS(bp));
                break;