Pass the length of the authentication data to print_fn, instead of

an arbitrary value taken from the packet (which can trivially
become negative, perhaps enabling buffer overruns).

diff --git a/print-vrrp.c b/print-vrrp.c
index caef77e08841c7ad9838fbaa2a5d774d5ee360f9..2fd3fef54b8a44df06c4e14e67d82cd146a15eeb 100644 (file)
--- a/print-vrrp.c
+++ b/print-vrrp.c
@@ -25,7 +25,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/tcpdump/print-vrrp.c,v 1.4 2001-07-20 03:16:23 guy Exp $";
+    "@(#) $Header: /tcpdump/master/tcpdump/print-vrrp.c,v 1.5 2001-07-23 22:27:30 fenner Exp $";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -129,7 +129,7 @@ vrrp_print(register const u_char *bp, register u_int len, int ttl)
                if (auth_type == VRRP_AUTH_SIMPLE) { /* simple text password */
                        TCHECK(bp[7]);
                        printf(" auth \"");
-                       fn_printn(bp, bp[7] - bp[0] + 1, NULL);
+                       fn_printn(bp, 8, NULL);
                        printf("\"");
                }
        }