Revert "Clean a bunch of fuzzed files not to fuzz the container."

[tcpdump] / print-juniper.c

diff --git a/print-juniper.c b/print-juniper.c
index 7c3df49ff2b145ec638c74245ed42c675042edb5..13d8f837a10912511cfafc3abcacb526f55201d7 100644 (file)
--- a/print-juniper.c
+++ b/print-juniper.c
@@ -30,6 +30,7 @@ __RCSID("NetBSD: print-juniper.c,v 1.3 2007/07/25 06:31:32 dogcow Exp ");
 
 #include <string.h>
 
+#define ND_LONGJMP_FROM_TCHECK
 #include "netdissect.h"
 #include "addrtoname.h"
 #include "extract.h"
@@ -516,11 +517,6 @@ juniper_ggsn_if_print(netdissect_options *ndo,
         }
 
         ndo->ndo_ll_hdr_len += l2info.header_len;
-        return;
-
-trunc:
-        nd_print_trunc(ndo);
-        ndo->ndo_ll_hdr_len += l2info.header_len;
 }
 #endif
 
@@ -599,11 +595,6 @@ juniper_es_if_print(netdissect_options *ndo,
 
         ip_print(ndo, p, l2info.length);
         ndo->ndo_ll_hdr_len += l2info.header_len;
-        return;
-
-trunc:
-        nd_print_trunc(ndo);
-        ndo->ndo_ll_hdr_len += l2info.header_len;
 }
 #endif
 
@@ -643,11 +634,6 @@ juniper_monitor_if_print(netdissect_options *ndo,
         ip_heuristic_guess (ndo, p, l2info.length);
 
         ndo->ndo_ll_hdr_len += l2info.header_len;
-        return;
-
-trunc:
-        nd_print_trunc(ndo);
-        ndo->ndo_ll_hdr_len += l2info.header_len;
 }
 #endif
 
@@ -689,11 +675,6 @@ juniper_services_if_print(netdissect_options *ndo,
         ip_heuristic_guess (ndo, p, l2info.length);
 
         ndo->ndo_ll_hdr_len += l2info.header_len;
-        return;
-
-trunc:
-        nd_print_trunc(ndo);
-        ndo->ndo_ll_hdr_len += l2info.header_len;
 }
 #endif
 
@@ -968,6 +949,8 @@ juniper_mfr_if_print(netdissect_options *ndo,
             ND_PRINT("Bundle-ID %u, ", l2info.bundle);
         switch (l2info.proto) {
         case (LLCSAP_ISONS<<8 | LLCSAP_ISONS):
+            /* At least one byte is required */
+            ND_TCHECK_1(p);
             isoclns_print(ndo, p + 1, l2info.length - 1);
             break;
         case (LLC_UI<<8 | NLPID_Q933):
@@ -1068,6 +1051,8 @@ juniper_atm1_if_print(netdissect_options *ndo,
         }
 
         if (GET_U_1(p) == 0x03) { /* Cisco style NLPID encaps ? */
+            /* At least one byte is required */
+            ND_TCHECK_1(p);
             isoclns_print(ndo, p + 1, l2info.length - 1);
             /* FIXME check if frame was recognized */
             ndo->ndo_ll_hdr_len += l2info.header_len;
@@ -1135,6 +1120,8 @@ juniper_atm2_if_print(netdissect_options *ndo,
         }
 
         if (GET_U_1(p) == 0x03) { /* Cisco style NLPID encaps ? */
+            /* At least one byte is required */
+            ND_TCHECK_1(p);
             isoclns_print(ndo, p + 1, l2info.length - 1);
             /* FIXME check if frame was recognized */
             ndo->ndo_ll_hdr_len += l2info.header_len;
@@ -1281,7 +1268,7 @@ juniper_parse_header(netdissect_options *ndo,
                      const u_char *p, const struct pcap_pkthdr *h, struct juniper_l2info_t *l2info)
 {
     const struct juniper_cookie_table_t *lp = juniper_cookie_table;
-    u_int idx, jnx_ext_len, jnx_header_len = 0;
+    u_int idx, extension_length, jnx_header_len = 0;
     uint8_t tlv_type,tlv_len;
 #ifdef DLT_JUNIPER_ATM2
     uint32_t control_word;
@@ -1321,20 +1308,20 @@ juniper_parse_header(netdissect_options *ndo,
         tptr = p+jnx_header_len;
 
         /* ok to read extension length ? */
-        jnx_ext_len = GET_BE_U_2(tptr);
+        extension_length = GET_BE_U_2(tptr);
         jnx_header_len += 2;
         tptr +=2;
 
         /* nail up the total length -
          * just in case something goes wrong
          * with TLV parsing */
-        jnx_header_len += jnx_ext_len;
+        jnx_header_len += extension_length;
 
         if (ndo->ndo_vflag > 1)
-            ND_PRINT(", PCAP Extension(s) total length %u", jnx_ext_len);
+            ND_PRINT(", PCAP Extension(s) total length %u", extension_length);
 
-        ND_TCHECK_LEN(tptr, jnx_ext_len);
-        while (jnx_ext_len > JUNIPER_EXT_TLV_OVERHEAD) {
+        ND_TCHECK_LEN(tptr, extension_length);
+        while (extension_length > JUNIPER_EXT_TLV_OVERHEAD) {
             tlv_type = GET_U_1(tptr);
             tptr++;
             tlv_len = GET_U_1(tptr);
@@ -1344,8 +1331,8 @@ juniper_parse_header(netdissect_options *ndo,
             /* sanity checks */
             if (tlv_type == 0 || tlv_len == 0)
                 break;
-            if (tlv_len+JUNIPER_EXT_TLV_OVERHEAD > jnx_ext_len)
-                goto trunc;
+            ND_ICHECK_U(extension_length, <,
+                        tlv_len + JUNIPER_EXT_TLV_OVERHEAD);
 
             if (ndo->ndo_vflag > 1)
                 ND_PRINT("\n\t  %s Extension TLV #%u, length %u, value ",
@@ -1388,7 +1375,7 @@ juniper_parse_header(netdissect_options *ndo,
             }
 
             tptr+=tlv_len;
-            jnx_ext_len -= tlv_len+JUNIPER_EXT_TLV_OVERHEAD;
+            extension_length -= tlv_len+JUNIPER_EXT_TLV_OVERHEAD;
         }
 
         if (ndo->ndo_vflag > 1)
@@ -1602,8 +1589,8 @@ juniper_parse_header(netdissect_options *ndo,
         ND_PRINT("hlen %u, proto 0x%04x, ", l2info->header_len, l2info->proto);
 
     return 1; /* everything went ok so far. continue parsing */
-trunc:
-    nd_print_trunc(ndo);
+invalid:
+    nd_print_invalid(ndo);
     return 0;
 }
 #endif /* defined(DLT_JUNIPER_GGSN) || defined(DLT_JUNIPER_ES) || \