NULL/LOOP: Add a bounds check

[tcpdump] / print-null.c

diff --git a/print-null.c b/print-null.c
index 27e8e4dcd75a41c1f7d2a8aef87bf933aebdddba..f1067ff5ca1d673560b0a7aad96b0026f786e125 100644 (file)
--- a/print-null.c
+++ b/print-null.c
@@ -22,16 +22,19 @@
 /* \summary: BSD loopback device printer */
 
 #ifdef HAVE_CONFIG_H
-#include "config.h"
+#include <config.h>
 #endif
 
-#include <netdissect-stdinc.h>
+#include "netdissect-stdinc.h"
 
 #include <string.h>
 
 #include "netdissect.h"
+#include "extract.h"
 #include "af.h"
 
+static const char tstr[] = " [|null]";
+
 /*
  * The DLT_NULL packet header is 4 bytes long. It contains a host-byte-order
  * 32-bit integer that specifies the family, e.g. AF_INET.
@@ -52,7 +55,7 @@
 #define        SWAPLONG(y) \
 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
 
-static inline void
+static void
 null_hdr_print(netdissect_options *ndo, u_int family, u_int length)
 {
        if (!ndo->ndo_qflag) {
@@ -77,13 +80,12 @@ null_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char
 {
        u_int length = h->len;
        u_int caplen = h->caplen;
-       u_int family;
+       uint32_t family;
 
-       if (caplen < NULL_HDRLEN) {
-               ND_PRINT("[|null]");
-               return (NULL_HDRLEN);
-       }
+       if (caplen < NULL_HDRLEN)
+               goto trunc;
 
+       ND_TCHECK_4(p);
        memcpy((char *)&family, (const char *)p, sizeof(family));
 
        /*
@@ -136,6 +138,9 @@ null_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char
                        ND_DEFAULTPRINT(p, caplen);
        }
 
+       return (NULL_HDRLEN);
+trunc:
+       ND_PRINT("%s", tstr);
        return (NULL_HDRLEN);
 }