X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/2be07da92397deef6fe652587d06779dbad3a535..f662dad02b51b595592df9fa6b0884e438cef9a3:/print-udp.c

diff --git a/print-udp.c b/print-udp.c
index d71e4d3a..8f07ef7d 100644
--- a/print-udp.c
+++ b/print-udp.c
@@ -437,7 +437,6 @@ udp_print(register const u_char *bp, u_int length,
 	else
 		ip6 = NULL;
 #endif /*INET6*/
-	cp = (u_char *)(up + 1);
 	if (!TTEST(up->uh_dport)) {
 		udpipaddr_print(ip, -1, -1);
 		(void)printf("[|udp]");
@@ -452,20 +451,24 @@ udp_print(register const u_char *bp, u_int length,
 		(void)printf("truncated-udp %d", length);
 		return;
 	}
-	length -= sizeof(struct udphdr);
-
-	if (cp > snapend) {
+	ulen = EXTRACT_16BITS(&up->uh_ulen);
+	if (ulen < sizeof(struct udphdr)) {
 		udpipaddr_print(ip, sport, dport);
-		(void)printf("[|udp]");
+		printf("truncated-udplength %d", ulen);
 		return;
 	}
+	ulen -= sizeof(struct udphdr);
+	length -= sizeof(struct udphdr);
+	if (ulen < length)
+		length = ulen;
 
-	ulen = EXTRACT_16BITS(&up->uh_ulen);
-	if (ulen < 8) {
+	cp = (u_char *)(up + 1);
+	if (cp > snapend) {
 		udpipaddr_print(ip, sport, dport);
-		(void)printf("truncated-udplength %d", ulen);
+		printf("[|udp]");
 		return;
 	}
+
 	if (packettype) {
 		register struct sunrpc_msg *rp;
 		enum sunrpc_msg_type direction;
@@ -701,12 +704,21 @@ udp_print(register const u_char *bp, u_int length,
 			sip_print((const u_char *)(up + 1), length);
                 else if (ISPORT(SYSLOG_PORT))
 			syslog_print((const u_char *)(up + 1), length);
-		else
-			(void)printf("UDP, length %u",
-			    (u_int32_t)(ulen - sizeof(*up)));
+		else {
+			if (ulen > length)
+				printf("UDP, bad length %u > %u",
+				    ulen, length);
+			else
+				printf("UDP, length %u", ulen);
+		}
 #undef ISPORT
-	} else
-		(void)printf("UDP, length %u", (u_int32_t)(ulen - sizeof(*up)));
+	} else {
+		if (ulen > length)
+			printf("UDP, bad length %u > %u",
+			    ulen, length);
+		else
+			printf("UDP, length %u", ulen);
+	}
 }