]> The Tcpdump Group git mirrors - tcpdump/commitdiff
OSPF: Fix two bounds checks
authorFrancois-Xavier Le Bail <[email protected]>
Sun, 17 Dec 2017 15:10:23 +0000 (16:10 +0100)
committerFrancois-Xavier Le Bail <[email protected]>
Sun, 17 Dec 2017 15:10:23 +0000 (16:10 +0100)
ND_TCHECK(*lp) test for only one byte.
A test for four bytes is needed.

print-ospf.c

index 9b8d7dd664f5756f40af3219cf75f340ac62e168..113ecde67b6f1d0b4c319bfe399aae43a623b9d0 100644 (file)
@@ -709,7 +709,7 @@ ospf_print_lsa(netdissect_options *ndo,
                while (lp < ls_end) {
                        uint32_t ul;
 
-                       ND_TCHECK(*lp);
+                       ND_TCHECK_4(lp);
                        ul = EXTRACT_BE_U_4(lp);
                         topology = (ul & SLA_MASK_TOS) >> SLA_SHIFT_TOS;
                        ND_PRINT((ndo, "\n\t\ttopology %s (%u) metric %d",
@@ -726,7 +726,7 @@ ospf_print_lsa(netdissect_options *ndo,
                while (lp < ls_end) {
                        uint32_t ul;
 
-                       ND_TCHECK(*lp);
+                       ND_TCHECK_4(lp);
                        ul = EXTRACT_BE_U_4(lp);
                         topology = (ul & SLA_MASK_TOS) >> SLA_SHIFT_TOS;
                        ND_PRINT((ndo, "\n\t\ttopology %s (%u) metric %d",