(for 4.9.3) AoE: Add another bounds check.

In aoev1_print() check bounds before fetching the Flags octet to prevent
a buffer over-read.

Found by code inspection hence there is no test case at this time.

diff --git a/print-aoe.c b/print-aoe.c
index 2c78a55d30322bc4e725c69630def4031c7db6f6..fcb75264fc1ac579afa7fb3474a4049eddd3a454 100644 (file)
--- a/print-aoe.c
+++ b/print-aoe.c
@@ -351,6 +351,7 @@ aoev1_print(netdissect_options *ndo,
        if (len < AOEV1_COMMON_HDR_LEN)
                goto invalid;
        /* Flags */
+       ND_TCHECK2(*cp, 1);
        flags = *cp & 0x0F;
        ND_PRINT((ndo, ", Flags: [%s]", bittok2str(aoev1_flag_str, "none", flags)));
        cp += 1;