Pointers into packet data should usually be pointers to unsigned 1-byte

[tcpdump] / print-sctp.c

diff --git a/print-sctp.c b/print-sctp.c
index 6606dbad6be505e1683565faec6cadb3fd12ce0d..d38cfde2d6755ddcb276b621346ddbbb2a0c4bc4 100644 (file)
--- a/print-sctp.c
+++ b/print-sctp.c
@@ -34,8 +34,8 @@
  */
 
 #ifndef lint
-static const char rcsid[] =
-"@(#) $Header: /tcpdump/master/tcpdump/print-sctp.c,v 1.11 2002-12-11 07:14:08 guy Exp $ (NETLAB/PEL)";
+static const char rcsid[] _U_ =
+"@(#) $Header: /tcpdump/master/tcpdump/print-sctp.c,v 1.20 2005-07-07 01:22:20 guy Exp $ (NETLAB/PEL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -68,12 +68,12 @@ void sctp_print(const u_char *bp,        /* beginning of sctp packet */
 #ifdef INET6
   const struct ip6_hdr *ip6;
 #endif
-  const u_char *cp;
   const void *endPacketPtr;
   u_short sourcePort, destPort;
   int chunkCount;
   const struct sctpChunkDesc *chunkDescPtr;
   const void *nextChunk;
+  const char *sep;
 
   sctpPktHdr = (const struct sctpHeader*) bp;
   endPacketPtr = (const u_char*)sctpPktHdr+sctpPacketLength;
@@ -87,12 +87,7 @@ void sctp_print(const u_char *bp,        /* beginning of sctp packet */
   else
     ip6 = NULL;
 #endif /*INET6*/
-  cp = (const u_char *)(sctpPktHdr + 1);
-  if (cp > snapend)
-    {
-      printf("[|sctp]");
-      return;
-    }
+  TCHECK(*sctpPktHdr);
 
   if (sctpPacketLength < sizeof(struct sctpHeader))
     {
@@ -109,35 +104,26 @@ void sctp_print(const u_char *bp,        /* beginning of sctp packet */
 
 #ifdef INET6
   if (ip6) {
-    if (ip6->ip6_nxt == IPPROTO_SCTP) {
-      (void)printf("%s.%d > %s.%d: sctp",
-        ip6addr_string(&ip6->ip6_src),
-        sourcePort,
-        ip6addr_string(&ip6->ip6_dst),
-        destPort);
-    } else {
-      (void)printf("%d > %d: sctp",
-        sourcePort, destPort);
-    }
+    (void)printf("%s.%d > %s.%d: sctp",
+      ip6addr_string(&ip6->ip6_src),
+      sourcePort,
+      ip6addr_string(&ip6->ip6_dst),
+      destPort);
   } else
 #endif /*INET6*/
   {
-    if (ip->ip_p == IPPROTO_SCTP) {
-      (void)printf("%s.%d > %s.%d: sctp",
-        ipaddr_string(&ip->ip_src),
-        sourcePort,
-        ipaddr_string(&ip->ip_dst),
-        destPort);
-    } else {
-      (void)printf("%d > %d: sctp",
-        sourcePort, destPort);
-    }
+    (void)printf("%s.%d > %s.%d: sctp",
+      ipaddr_string(&ip->ip_src),
+      sourcePort,
+      ipaddr_string(&ip->ip_dst),
+      destPort);
   }
   fflush(stdout);
 
-  if (vflag < 2)
-       return;
-
+  if (vflag >= 2)
+    sep = "\n\t";
+  else
+    sep = " (";
   /* cycle through all chunks, printing information on each one */
   for (chunkCount = 0,
         chunkDescPtr = (const struct sctpChunkDesc *)
@@ -149,18 +135,27 @@ void sctp_print(const u_char *bp,        /* beginning of sctp packet */
 
        chunkDescPtr = (const struct sctpChunkDesc *) nextChunk, chunkCount++)
     {
-      u_short align;
+      u_int16_t chunkLength;
       const u_char *chunkEnd;
+      u_int16_t align;
+
+      TCHECK(*chunkDescPtr);
+      chunkLength = EXTRACT_16BITS(&chunkDescPtr->chunkLength);
+      if (chunkLength < sizeof(*chunkDescPtr)) {
+       printf("%s%d) [Bad chunk length %u]", sep, chunkCount+1, chunkLength);
+       break;
+      }
 
-      chunkEnd = ((const u_char*)chunkDescPtr + EXTRACT_16BITS(&chunkDescPtr->chunkLength));
+      TCHECK2(*((u_int8_t *)chunkDescPtr), chunkLength);
+      chunkEnd = ((const u_char*)chunkDescPtr + chunkLength);
 
-      align=EXTRACT_16BITS(&chunkDescPtr->chunkLength) % 4;
+      align=chunkLength % 4;
       if (align != 0)
        align = 4 - align;
 
       nextChunk = (const void *) (chunkEnd + align);
 
-      printf("\n\t%d) ", chunkCount+1);
+      printf("%s%d) ", sep, chunkCount+1);
       switch (chunkDescPtr->chunkID)
        {
        case SCTP_DATA :
@@ -199,18 +194,26 @@ void sctp_print(const u_char *bp,        /* beginning of sctp packet */
            printf("[PPID 0x%x] ", EXTRACT_32BITS(&dataHdrPtr->payloadtype));
            fflush(stdout);
 
-           if (vflag)          /* if verbose output is specified */
+           if (vflag >= 2)        /* if verbose output is specified */
              {                    /* at the command line */
                const u_char *payloadPtr;
 
                printf("[Payload");
 
-               if (!xflag && !qflag) {
+               if (!suppress_default_print) {
                        payloadPtr = (const u_char *) (++dataHdrPtr);
                        printf(":");
+                       if (htons(chunkDescPtr->chunkLength) <
+                           sizeof(struct sctpDataPart)+
+                           sizeof(struct sctpChunkDesc)+1) {
+                               printf("bogus chunk length %u]",
+                                   htons(chunkDescPtr->chunkLength));
+                               return;
+                       }
                        default_print(payloadPtr,
-                             htons(chunkDescPtr->chunkLength)-1 -
-                             sizeof(struct sctpDataPart)-sizeof(struct sctpChunkDesc));
+                             htons(chunkDescPtr->chunkLength) -
+                             (sizeof(struct sctpDataPart)+
+                             sizeof(struct sctpChunkDesc)+1));
                } else
                        printf("]");
              }
@@ -259,7 +262,7 @@ void sctp_print(const u_char *bp,        /* beginning of sctp packet */
            const struct sctpSelectiveAck *sack;
            const struct sctpSelectiveFrag *frag;
            int fragNo, tsnNo;
-           const u_long *dupTSN;
+           const u_char *dupTSN;
 
            printf("[SACK] ");
            sack=(const struct sctpSelectiveAck*)(chunkDescPtr+1);
@@ -282,9 +285,9 @@ void sctp_print(const u_char *bp,        /* beginning of sctp packet */
 
 
            /* print duplicate TSNs */
-           for (dupTSN = (const u_long*)frag, tsnNo=0;
+           for (dupTSN = (const u_char *)frag, tsnNo=0;
                 (const void *) dupTSN < nextChunk && tsnNo<EXTRACT_16BITS(&sack->numDupTsns);
-                dupTSN++, tsnNo++)
+                dupTSN += 4, tsnNo++)
              printf("\n\t\t[dup TSN #%u: %u] ", tsnNo+1,
                  EXTRACT_32BITS(dupTSN));
 
@@ -343,5 +346,13 @@ void sctp_print(const u_char *bp,        /* beginning of sctp packet */
          printf("[Unknown chunk type: 0x%x]", chunkDescPtr->chunkID);
          return;
        }
+
+       if (vflag < 2)
+         sep = ", (";
     }
+    return;
+
+trunc:
+    printf("[|sctp]");
+    return;
 }