X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/39d15607cad1b4b463794c1a67873f6182dc52f7..1fb50928ce27360c1c987312774f686b23c69b51:/print-dtp.c

diff --git a/print-dtp.c b/print-dtp.c
index e502ad54..1d8c66a0 100644
--- a/print-dtp.c
+++ b/print-dtp.c
@@ -12,21 +12,23 @@
  * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  * FOR A PARTICULAR PURPOSE.
  *
- * Dynamic Trunk Protocol (DTP)
- *
  * Original code by Carles Kishimoto <carles.kishimoto@gmail.com>
  */
 
+/* \summary: Dynamic Trunking Protocol (DTP) printer */
+
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
 
-#include <tcpdump-stdinc.h>
+#include <netdissect-stdinc.h>
 
 #include "netdissect.h"
 #include "addrtoname.h"
 #include "extract.h"
 
+static const char tstr[] = " [|dtp]";
+
 #define DTP_HEADER_LEN			1
 #define DTP_DOMAIN_TLV			0x0001
 #define DTP_STATUS_TLV			0x0002
@@ -52,8 +54,7 @@ dtp_print (netdissect_options *ndo, const u_char *pptr, u_int length)
 
     tptr = pptr;
 
-    if (!ND_TTEST2(*tptr, DTP_HEADER_LEN))
-	goto trunc;
+    ND_TCHECK2(*tptr, DTP_HEADER_LEN);
 
     ND_PRINT((ndo, "DTPv%u, length %u",
            (*tptr),
@@ -70,33 +71,38 @@ dtp_print (netdissect_options *ndo, const u_char *pptr, u_int length)
 
     while (tptr < (pptr+length)) {
 
-        if (!ND_TTEST2(*tptr, 4))
-            goto trunc;
-
+        ND_TCHECK2(*tptr, 4);
 	type = EXTRACT_16BITS(tptr);
         len  = EXTRACT_16BITS(tptr+2);
-
-        /* infinite loop check */
-        if (type == 0 || len == 0) {
+       /* XXX: should not be but sometimes it is, see the test captures */
+        if (type == 0)
             return;
-        }
-
         ND_PRINT((ndo, "\n\t%s (0x%04x) TLV, length %u",
                tok2str(dtp_tlv_values, "Unknown", type),
                type, len));
 
+        /* infinite loop check */
+        if (len < 4)
+            goto invalid;
+        ND_TCHECK2(*tptr, len);
+
         switch (type) {
 	case DTP_DOMAIN_TLV:
-		ND_PRINT((ndo, ", %s", tptr+4));
+		ND_PRINT((ndo, ", "));
+		fn_printzp(ndo, tptr+4, len-4, pptr+length);
 		break;
 
 	case DTP_STATUS_TLV:
 	case DTP_DTP_TYPE_TLV:
+                if (len < 5)
+                    goto invalid;
                 ND_PRINT((ndo, ", 0x%x", *(tptr+4)));
                 break;
 
 	case DTP_NEIGHBOR_TLV:
-                ND_PRINT((ndo, ", %s", etheraddr_string(tptr+4)));
+                if (len < 10)
+                    goto invalid;
+                ND_PRINT((ndo, ", %s", etheraddr_string(ndo, tptr+4)));
                 break;
 
         default:
@@ -107,8 +113,11 @@ dtp_print (netdissect_options *ndo, const u_char *pptr, u_int length)
 
     return;
 
+ invalid:
+    ND_PRINT((ndo, "%s", istr));
+    return;
  trunc:
-    ND_PRINT((ndo, "[|dtp]"));
+    ND_PRINT((ndo, "%s", tstr));
 }
 
 /*