X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/87dba333228b638fa7d3a60197f8ab8c82743043..febd0bc5aa33b3de9b5864e8c5565fe7b63f519f:/print-tcp.c?ds=sidebyside

diff --git a/print-tcp.c b/print-tcp.c
index 61fb93e6..c9b50fee 100644
--- a/print-tcp.c
+++ b/print-tcp.c
@@ -190,8 +190,6 @@ tcp_print(netdissect_options *ndo,
         sport = EXTRACT_16BITS(&tp->th_sport);
         dport = EXTRACT_16BITS(&tp->th_dport);
 
-        hlen = TH_OFF(tp) * 4;
-
         if (ip6) {
                 if (ip6->ip6_nxt == IPPROTO_TCP) {
                         ND_PRINT((ndo, "%s.%s > %s.%s: ",
@@ -216,14 +214,16 @@ tcp_print(netdissect_options *ndo,
                 }
         }
 
+        ND_TCHECK(*tp);
+
+        hlen = TH_OFF(tp) * 4;
+
         if (hlen < sizeof(*tp)) {
                 ND_PRINT((ndo, " tcp %d [bad hdr length %u - too short, < %lu]",
                              length - hlen, hlen, (unsigned long)sizeof(*tp)));
                 return;
         }
 
-        ND_TCHECK(*tp);
-
         seq = EXTRACT_32BITS(&tp->th_seq);
         ack = EXTRACT_32BITS(&tp->th_ack);
         win = EXTRACT_16BITS(&tp->th_win);
@@ -252,12 +252,12 @@ tcp_print(netdissect_options *ndo,
                 if (ip6) {
                         register struct tcp_seq_hash6 *th;
                         struct tcp_seq_hash6 *tcp_seq_hash;
-                        const struct in6_addr *src, *dst;
+                        const void *src, *dst;
                         struct tha6 tha;
 
                         tcp_seq_hash = tcp_seq_hash6;
-                        src = &ip6->ip6_src;
-                        dst = &ip6->ip6_dst;
+                        src = (const void *)&ip6->ip6_src;
+                        dst = (const void *)&ip6->ip6_dst;
                         if (sport > dport)
                                 rev = 1;
                         else if (sport == dport) {
@@ -546,7 +546,6 @@ tcp_print(netdissect_options *ndo,
 
                         case TCPOPT_TCPAO:
                                 datalen = len - 2;
-                                LENCHECK(datalen);
                                 /* RFC 5925 Section 2.2:
                                  * "The Length value MUST be greater than or equal to 4."
                                  * (This includes the Kind and Length fields already processed
@@ -555,11 +554,16 @@ tcp_print(netdissect_options *ndo,
                                 if (datalen < 2) {
                                         ND_PRINT((ndo, " invalid"));
                                 } else {
-                                        ND_PRINT((ndo, " keyid %u rnextkeyid %u", cp[0], cp[1]));
+                                        LENCHECK(1);
+                                        ND_PRINT((ndo, " keyid %u", cp[0]));
+                                        LENCHECK(2);
+                                        ND_PRINT((ndo, " rnextkeyid %u", cp[1]));
                                         if (datalen > 2) {
-                                                ND_PRINT((ndo, " mac "));
-                                                for (i = 2; i < datalen; i++)
+                                                ND_PRINT((ndo, " mac 0x"));
+                                                for (i = 2; i < datalen; i++) {
+                                                        LENCHECK(i + 1);
                                                         ND_PRINT((ndo, "%02x", cp[i]));
+                                                }
                                         }
                                 }
                                 break;
@@ -626,7 +630,7 @@ tcp_print(netdissect_options *ndo,
                                 if (datalen)
                                         ND_PRINT((ndo, " 0x"));
                                 for (i = 0; i < datalen; ++i) {
-                                        LENCHECK(i);
+                                        LENCHECK(i + 1);
                                         ND_PRINT((ndo, "%02x", cp[i]));
                                 }
                                 break;