IPX SAP requests don't have service names in them, they just have a

service type.

Fix the bounds check for the body of an IPX SAP response.

diff --git a/print-ipx.c b/print-ipx.c
index 0c4c501fa77ad40e2be6d2ba32bfb9385f931857..43b691ed09eac002a49007a6ef969d9292454773 100644 (file)
--- a/print-ipx.c
+++ b/print-ipx.c
@@ -24,7 +24,7 @@
 
 #ifndef lint
 static const char rcsid[] =
 
 #ifndef lint
 static const char rcsid[] =

-    "@(#) $Header: /tcpdump/master/tcpdump/print-ipx.c,v 1.28 2001-01-15 00:43:59 guy Exp $";
+    "@(#) $Header: /tcpdump/master/tcpdump/print-ipx.c,v 1.29 2001-01-15 02:23:25 guy Exp $";

 #endif
 
 #ifdef HAVE_CONFIG_H
 #endif
 
 #ifdef HAVE_CONFIG_H


@@ -139,12 +139,8 @@ ipx_sap_print(const u_short *ipx, u_int length)
        else
            (void)printf("ipx-sap-nearest-req");
 
        else
            (void)printf("ipx-sap-nearest-req");
 

-       if (length > 0) {
-           TCHECK(ipx[1]);
-           (void)printf(" %x '", EXTRACT_16BITS(&ipx[0]));
-           fn_print((u_char *)&ipx[1], (u_char *)&ipx[1] + 48);
-           putchar('\'');
-       }
+       TCHECK(ipx[0]);
+       (void)printf(" %x", EXTRACT_16BITS(&ipx[0]));

        break;
 
       case 2:
        break;
 
       case 2:


@@ -155,7 +151,7 @@ ipx_sap_print(const u_short *ipx, u_int length)
            (void)printf("ipx-sap-nearest-resp");
 
        for (i = 0; i < 8 && length > 0; i++) {
            (void)printf("ipx-sap-nearest-resp");
 
        for (i = 0; i < 8 && length > 0; i++) {

-           TCHECK2(ipx[27], 1);
+           TCHECK2(ipx[25], 10);

            (void)printf(" %x '", EXTRACT_16BITS(&ipx[0]));
            fn_print((u_char *)&ipx[1], (u_char *)&ipx[1] + 48);
            printf("' addr %s",
            (void)printf(" %x '", EXTRACT_16BITS(&ipx[0]));
            fn_print((u_char *)&ipx[1], (u_char *)&ipx[1] + 48);
            printf("' addr %s",


@@ -165,12 +161,12 @@ ipx_sap_print(const u_short *ipx, u_int length)
        }
        break;
       default:
        }
        break;
       default:

-           (void)printf("ipx-sap-?%x", command);
+       (void)printf("ipx-sap-?%x", command);

        break;
     }
        break;
     }

-       return;
+    return;

 trunc:
 trunc:

-       printf("[|ipx %d]", length);
+    printf("[|ipx %d]", length);

 }
 
 void
 }
 
 void


@@ -204,10 +200,11 @@ ipx_rip_print(const u_short *ipx, u_int length)
        }
        break;
       default:
        }
        break;
       default:

-           (void)printf("ipx-rip-?%x", command);
+       (void)printf("ipx-rip-?%x", command);
+       break;

     }
     }

-       return;
+    return;

 trunc:
 trunc:

-       printf("[|ipx %d]", length);
+    printf("[|ipx %d]", length);

 }
 
 }