X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/cfa9ab5f80dd9a1024e1a765bc0d24c57652b6bc..c43334b0d460eaee9de0a9186f2fb16ffe3d9ca9:/print-l2tp.c

diff --git a/print-l2tp.c b/print-l2tp.c
index 184ff752..89215505 100644
--- a/print-l2tp.c
+++ b/print-l2tp.c
@@ -577,7 +577,7 @@ l2tp_avp_print(netdissect_options *ndo, const u_char *dat, u_int length)
 	len = GET_BE_U_2(dat) & L2TP_AVP_HDR_LEN_MASK;
 
 	/* If it is not long enough to contain the header, we'll give up. */
-	ND_LCHECKMSG_U(len, 6, "AVP length");
+	ND_ICHECKMSG_U("AVP length", len, <, 6);
 
 	/* If it goes past the end of the remaining length of the packet,
 	   we'll give up. */
@@ -807,6 +807,8 @@ l2tp_print(netdissect_options *ndo, const u_char *dat, u_int length)
 
 	if (flag_o) {	/* Offset Size */
 		pad =  GET_BE_U_2(ptr);
+		/* Offset padding octets in packet buffer? */
+		ND_TCHECK_LEN(ptr + 2, pad);
 		ptr += (2 + pad);
 		cnt += (2 + pad);
 	}