- ND_TCHECK2(*tptr, 4); /* read out Type and Length */
- type = EXTRACT_16BITS(tptr);
- len = EXTRACT_16BITS(tptr+2); /* object length includes the 4 bytes header length */
- tptr += 4;
- len -= 4;
-
- ND_TCHECK2(*tptr, len);
-
- if (ndo->ndo_vflag || type == 1) { /* in non-verbose mode just print Device-ID */
-
- if (ndo->ndo_vflag)
- ND_PRINT((ndo, "\n\t%s (0x%02x), length: %u byte%s: ",
- tok2str(cdp_tlv_values,"unknown field type", type),
- type,
- len,
- PLURAL_SUFFIX(len))); /* plural */
-
- switch (type) {
-
- case 0x01: /* Device-ID */
- if (!ndo->ndo_vflag)
- ND_PRINT((ndo, ", Device-ID "));
- ND_PRINT((ndo, "'"));
- fn_printn(ndo, tptr, len, NULL);
- ND_PRINT((ndo, "'"));
+ ND_TCHECK_LEN(tptr, CDP_TLV_HEADER_LEN); /* read out Type and Length */
+ type = GET_BE_U_2(tptr + CDP_TLV_TYPE_OFFSET);
+ len = GET_BE_U_2(tptr + CDP_TLV_LEN_OFFSET); /* object length includes the 4 bytes header length */
+ if (len < CDP_TLV_HEADER_LEN) {
+ if (ndo->ndo_vflag)
+ ND_PRINT("\n\t%s (0x%02x), TLV length: %u byte%s (too short)",
+ tok2str(cdp_tlv_values,"unknown field type", type),
+ type,
+ len,
+ PLURAL_SUFFIX(len)); /* plural */
+ else
+ ND_PRINT(", %s TLV length %u too short",
+ tok2str(cdp_tlv_values,"unknown field type", type),
+ len);
+ break;
+ }
+ tptr += CDP_TLV_HEADER_LEN;
+ len -= CDP_TLV_HEADER_LEN;
+
+ ND_TCHECK_LEN(tptr, len);
+
+ if (ndo->ndo_vflag || type == 1) { /* in non-verbose mode just print Device-ID */
+
+ if (ndo->ndo_vflag)
+ ND_PRINT("\n\t%s (0x%02x), value length: %u byte%s: ",
+ tok2str(cdp_tlv_values,"unknown field type", type),
+ type,
+ len,
+ PLURAL_SUFFIX(len)); /* plural */
+
+ switch (type) {
+
+ case 0x01: /* Device-ID */
+ if (!ndo->ndo_vflag)
+ ND_PRINT(", Device-ID ");
+ ND_PRINT("'");
+ (void)nd_printn(ndo, tptr, len, NULL);
+ ND_PRINT("'");