X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/7b2c5a11a7bc236d72b440c4db5263edb23b4880..1a04b92e365f5ed01ca38619b41bcc4fc9cbd63c:/print-dtp.c

diff --git a/print-dtp.c b/print-dtp.c
index 5983b843..bf1242e0 100644
--- a/print-dtp.c
+++ b/print-dtp.c
@@ -12,21 +12,23 @@
  * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  * FOR A PARTICULAR PURPOSE.
  *
- * Dynamic Trunk Protocol (DTP)
- *
  * Original code by Carles Kishimoto <carles.kishimoto@gmail.com>
  */
 
+/* \summary: Dynamic Trunking Protocol (DTP) printer */
+
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
 
-#include <tcpdump-stdinc.h>
+#include <netdissect-stdinc.h>
 
-#include "interface.h"
+#include "netdissect.h"
 #include "addrtoname.h"
 #include "extract.h"
 
+static const char tstr[] = " [|dtp]";
+
 #define DTP_HEADER_LEN			1
 #define DTP_DOMAIN_TLV			0x0001
 #define DTP_STATUS_TLV			0x0002
@@ -52,10 +54,10 @@ dtp_print (netdissect_options *ndo, const u_char *pptr, u_int length)
 
     tptr = pptr;
 
-    ND_TCHECK2(*tptr, DTP_HEADER_LEN);
+    ND_TCHECK_LEN(tptr, DTP_HEADER_LEN);
 
     ND_PRINT((ndo, "DTPv%u, length %u",
-           (*tptr),
+           EXTRACT_U_1(tptr),
            length));
 
     /*
@@ -69,31 +71,37 @@ dtp_print (netdissect_options *ndo, const u_char *pptr, u_int length)
 
     while (tptr < (pptr+length)) {
 
-        ND_TCHECK2(*tptr, 4);
-
-	type = EXTRACT_16BITS(tptr);
-        len  = EXTRACT_16BITS(tptr+2);
-
-        /* infinite loop check */
-        if (type == 0 || len == 0) {
+        ND_TCHECK_4(tptr);
+	type = EXTRACT_BE_U_2(tptr);
+        len  = EXTRACT_BE_U_2(tptr + 2);
+       /* XXX: should not be but sometimes it is, see the test captures */
+        if (type == 0)
             return;
-        }
-
         ND_PRINT((ndo, "\n\t%s (0x%04x) TLV, length %u",
                tok2str(dtp_tlv_values, "Unknown", type),
                type, len));
 
+        /* infinite loop check */
+        if (len < 4)
+            goto invalid;
+        ND_TCHECK_LEN(tptr, len);
+
         switch (type) {
 	case DTP_DOMAIN_TLV:
-		ND_PRINT((ndo, ", %s", tptr+4));
+		ND_PRINT((ndo, ", "));
+		fn_printzp(ndo, tptr+4, len-4, pptr+length);
 		break;
 
 	case DTP_STATUS_TLV:
 	case DTP_DTP_TYPE_TLV:
-                ND_PRINT((ndo, ", 0x%x", *(tptr+4)));
+                if (len < 5)
+                    goto invalid;
+                ND_PRINT((ndo, ", 0x%x", EXTRACT_U_1(tptr + 4)));
                 break;
 
 	case DTP_NEIGHBOR_TLV:
+                if (len < 10)
+                    goto invalid;
                 ND_PRINT((ndo, ", %s", etheraddr_string(ndo, tptr+4)));
                 break;
 
@@ -105,8 +113,11 @@ dtp_print (netdissect_options *ndo, const u_char *pptr, u_int length)
 
     return;
 
+ invalid:
+    ND_PRINT((ndo, "%s", istr));
+    return;
  trunc:
-    ND_PRINT((ndo, "[|dtp]"));
+    ND_PRINT((ndo, "%s", tstr));
 }
 
 /*