From Mark Ellzey Thomas <[email protected]>: check the length of a data

chunk before printing it.

diff --git a/CREDITS b/CREDITS
index 8a1f51be43f71e9bdcd7df2f1918e7db82760bc4..e9841302b6ed70d8ee7d9c9f32a2b2f893ef47e2 100644 (file)
--- a/CREDITS
+++ b/CREDITS
@@ -69,6 +69,7 @@ Additional people who have contributed patches:
        Love Hörnquist-Åstrand          <[email protected]>
        Maciej W. Rozycki               <[email protected]>
        Marc A. Lehmann                 <[email protected]>
+       Mark Ellzey Thomas              <[email protected]>
        Marko Kiiskila                  <[email protected]>
        Marshall Rose                   <[email protected]>
        Martin Husemann                 <[email protected]>

diff --git a/print-sctp.c b/print-sctp.c
index cb6c4d671f44f275ef90c2fc23f48a3b1749482b..937f5e5c74165852041854553dc9834c209c757f 100644 (file)
--- a/print-sctp.c
+++ b/print-sctp.c
@@ -35,7 +35,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-"@(#) $Header: /tcpdump/master/tcpdump/print-sctp.c,v 1.12 2003-06-03 23:49:23 guy Exp $ (NETLAB/PEL)";
+"@(#) $Header: /tcpdump/master/tcpdump/print-sctp.c,v 1.13 2003-08-06 05:02:13 guy Exp $ (NETLAB/PEL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -198,9 +198,17 @@ void sctp_print(const u_char *bp,        /* beginning of sctp packet */
                if (!xflag && !qflag) {
                        payloadPtr = (const u_char *) (++dataHdrPtr);
                        printf(":");
+                       if (htons(chunkDescPtr->chunkLength) <
+                           sizeof(struct sctpDataPart)+
+                           sizeof(struct sctpChunkDesc)+1) {
+                               printf("bogus chunk length %u]",
+                                   htons(chunkDescPtr->chunkLength));
+                               return;
+                       }
                        default_print(payloadPtr,
-                             htons(chunkDescPtr->chunkLength)-1 -
-                             sizeof(struct sctpDataPart)-sizeof(struct sctpChunkDesc));
+                             htons(chunkDescPtr->chunkLength) -
+                             (sizeof(struct sctpDataPart)+
+                             sizeof(struct sctpChunkDesc)+1));
                } else
                        printf("]");
              }