Based on a patch from Michele "mydecay" Marchetto <[email protected]>:

check the header length to make sure it's at least the minimum length,
so we don't, for example, go into an infinite loop if the header length
is 0.

Get rid of some blank lines at the end of the file.

diff --git a/CREDITS b/CREDITS
index 620b523035d995a1b6c039666e017a24abb790b2..da63e61cc726953189a1ce3a59f51ee45e88f025 100644 (file)
--- a/CREDITS
+++ b/CREDITS
@@ -73,6 +73,7 @@ Additional people who have contributed patches:
        Michael Madore                  <[email protected]>
        Michael Shalayeff               <[email protected]>
        Michael T. Stolarchuk           <[email protected]>
+       Michele "mydecay" Marchetto     <[email protected]>
        Monroe Williams                 <[email protected]>
        Motonori Shindo                 <[email protected]>
        Nathan J. Williams              <[email protected]>

diff --git a/print-bgp.c b/print-bgp.c
index 6a9f048681216fd6bfead46391b915904e74cb40..8545f7a41f9a7e1d330aaf90ee3450c6e1c4419f 100644 (file)
--- a/print-bgp.c
+++ b/print-bgp.c
@@ -36,7 +36,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-     "@(#) $Header: /tcpdump/master/tcpdump/print-bgp.c,v 1.66 2003-06-03 22:15:58 guy Exp $";
+     "@(#) $Header: /tcpdump/master/tcpdump/print-bgp.c,v 1.67 2003-06-03 23:23:50 guy Exp $";
 #endif
 
 #include <tcpdump-stdinc.h>
@@ -1587,6 +1587,11 @@ bgp_print(const u_char *dat, int length)
                        printf(" [|BGP]");
 
                hlen = ntohs(bgp.bgp_len);
+               if (hlen < BGP_SIZE) {
+                       printf("\n[|BGP Bogus header length %u < %u]", hlen,
+                           BGP_SIZE);
+                       break;
+               }
 
                if (TTEST2(p[0], hlen)) {
                        bgp_header_print(p, hlen);
@@ -1603,14 +1608,3 @@ bgp_print(const u_char *dat, int length)
 trunc:
        printf(" [|BGP]");
 }
-
-
-
-
-
-
-
-
-
-
-