X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/99c91c3aec40b691641374f58e798bd8d6b657bd..de0c7fc746c37eb83e15a6890d30dc6f608e9d76:/print-mpls.c?ds=inline

diff --git a/print-mpls.c b/print-mpls.c
index 504ce197..9d773214 100644
--- a/print-mpls.c
+++ b/print-mpls.c
@@ -26,6 +26,8 @@
  * SUCH DAMAGE.
  */
 
+/* \summary: Multi-Protocol Label Switching (MPLS) printer */
+
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
@@ -66,7 +68,11 @@ mpls_print(netdissect_options *ndo, const u_char *bp, u_int length)
 	ND_PRINT((ndo, "MPLS"));
 	do {
 		ND_TCHECK2(*p, sizeof(label_entry));
-		label_entry = EXTRACT_32BITS(p);
+		if (length < sizeof(label_entry)) {
+			ND_PRINT((ndo, "[|MPLS], length %u", length));
+			return;
+		}
+		label_entry = EXTRACT_BE_U_4(p);
 		ND_PRINT((ndo, "%s(label %u",
 		       (label_stack_depth && ndo->ndo_vflag) ? "\n\t" : " ",
        		       MPLS_LABEL(label_entry)));
@@ -80,6 +86,7 @@ mpls_print(netdissect_options *ndo, const u_char *bp, u_int length)
 		ND_PRINT((ndo, ", ttl %u)", MPLS_TTL(label_entry)));
 
 		p += sizeof(label_entry);
+		length -= sizeof(label_entry);
 	} while (!MPLS_STACK(label_entry));
 
 	/*
@@ -122,6 +129,11 @@ mpls_print(netdissect_options *ndo, const u_char *bp, u_int length)
 		 * Cisco sends control-plane traffic MPLS-encapsulated in
 		 * this fashion.
 		 */
+		ND_TCHECK(*p);
+		if (length < 1) {
+			/* nothing to print */
+			return;
+		}
 		switch(*p) {
 
 		case 0x45:
@@ -174,22 +186,22 @@ mpls_print(netdissect_options *ndo, const u_char *bp, u_int length)
 	 */
 	if (pt == PT_UNKNOWN) {
 		if (!ndo->ndo_suppress_default_print)
-			ND_DEFAULTPRINT(p, length - (p - bp));
+			ND_DEFAULTPRINT(p, length);
 		return;
 	}
 	ND_PRINT((ndo, ndo->ndo_vflag ? "\n\t" : " "));
 	switch (pt) {
 
 	case PT_IPV4:
-		ip_print(ndo, p, length - (p - bp));
+		ip_print(ndo, p, length);
 		break;
 
 	case PT_IPV6:
-		ip6_print(ndo, p, length - (p - bp));
+		ip6_print(ndo, p, length);
 		break;
 
 	case PT_OSI:
-		isoclns_print(ndo, p, length - (p - bp), length - (p - bp));
+		isoclns_print(ndo, p, length);
 		break;
 
 	default: