Pointers into packet data should usually be pointers to unsigned 1-byte

[tcpdump] / print-radius.c

diff --git a/print-radius.c b/print-radius.c
index d388a8f1278fcc50fc044501e9f75314650637fc..cf5b5983035522d0f7bdaa8d672005a5f5cec3e9 100644 (file)
--- a/print-radius.c
+++ b/print-radius.c
@@ -44,7 +44,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "$Id: print-radius.c,v 1.24 2004-01-07 08:00:52 hannes Exp $";
+    "$Id: print-radius.c,v 1.27 2004-07-21 21:45:47 guy Exp $";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -503,13 +503,20 @@ print_vendor_attr(register u_char *data, u_int length, u_short attr_code _U_)
     length-=4;
 
     printf("Vendor: %s (%u)",
-           tok2str(oui_values,"Unknown",vendor_id),
+           tok2str(smi_values,"Unknown",vendor_id),
            vendor_id);
 
     while (length >= 2) {
+       if(!TTEST2(*data, 2)) 
+               return;
+
         vendor_type = *(data);
         vendor_length = *(data+1);
+
         data+=2;
+       if(!TTEST2(*data, vendor_length))
+               return;
+
         printf("\n\t    Vendor Attribute: %u, Length: %u, Value: ",
                vendor_type,
                vendor_length);
@@ -803,14 +810,14 @@ radius_attr_print(register const u_char *attr, u_int length)
 
    while (length > 0)
    {
-     if (rad_attr->len == 0)
+     if (rad_attr->len == 0 && rad_attr->type < (TAM_SIZE(attr_type)-1))
      {
        printf("\n\t  %s Attribute (%u), zero-length",
                attr_type[rad_attr->type].name,
                rad_attr->type);
        return;
      }
-     if ( rad_attr->len <= length )
+     if ( rad_attr->len <= length && rad_attr->type < (TAM_SIZE(attr_type)-1))
      {
          printf("\n\t  %s Attribute (%u), length: %u, Value: ",
                 attr_type[rad_attr->type].name,
@@ -833,9 +840,9 @@ radius_attr_print(register const u_char *attr, u_int length)
         printf(" [|radius]");
         return;
      }
-     /* do we want to see an additionally hexdump ? */
-     if (vflag> 1)
-         print_unknown_data((char *)rad_attr+2,"\n\t    ",(rad_attr->len)-2);
+     /* do we also want to see a hex dump ? */
+     if (vflag> 1 && rad_attr->len >= 2)
+         print_unknown_data((u_char *)rad_attr+2,"\n\t    ",(rad_attr->len)-2);
 
      length-=(rad_attr->len);
      rad_attr = (struct radius_attr *)( ((char *)(rad_attr))+rad_attr->len);