SMB: Add two missing bounds checks

[tcpdump] / print-ldp.c

diff --git a/print-ldp.c b/print-ldp.c
index 87805d2465437525e6c36155e4fe4d7ec021d84e..680a7e1e8fc135824dc746e4f367f0c7a83bc579 100644 (file)
--- a/print-ldp.c
+++ b/print-ldp.c
@@ -233,10 +233,10 @@ static int ldp_pdu_print(netdissect_options *, const u_char *);
 #define TLV_TCHECK(minlen) \
     ND_TCHECK_LEN(tptr, minlen); if (tlv_tlen < minlen) goto badtlv;
 
-static int
+static u_int
 ldp_tlv_print(netdissect_options *ndo,
               const u_char *tptr,
-              u_short msg_tlen)
+              u_int msg_tlen)
 {
     struct ldp_tlv_header {
         nd_uint16_t type;
@@ -253,7 +253,7 @@ ldp_tlv_print(netdissect_options *ndo,
     ldp_tlv_header = (const struct ldp_tlv_header *)tptr;
     ND_TCHECK_SIZE(ldp_tlv_header);
     tlv_len=GET_BE_U_2(ldp_tlv_header->length);
-    if (tlv_len + 4 > msg_tlen) {
+    if (tlv_len + 4U > msg_tlen) {
         ND_PRINT("\n\t\t TLV contents go past end of message");
         return 0;
     }
@@ -567,7 +567,8 @@ ldp_pdu_print(netdissect_options *ndo,
     const struct ldp_msg_header *ldp_msg_header;
     const u_char *tptr,*msg_tptr;
     u_short tlen;
-    u_short pdu_len,msg_len,msg_type,msg_tlen;
+    u_short pdu_len,msg_len,msg_type;
+    u_int msg_tlen;
     int hexdump,processed;
 
     ldp_com_header = (const struct ldp_common_header *)pptr;