IP6OPTS: Fix some truncation codes

Moreover:
Update the output of some tests accordingly.
Fix style.

diff --git a/print-ip6opts.c b/print-ip6opts.c
index 35e8763001f044021539daddede07f08168d610f..ab07c06ef328b84a0bd77d92050d2f6444091905 100644 (file)
--- a/print-ip6opts.c
+++ b/print-ip6opts.c
@@ -41,7 +41,7 @@
 
 #include "ip6.h"
 
-static void
+static int
 ip6_sopt_print(netdissect_options *ndo, const u_char *bp, int len)
 {
     int i;
@@ -79,20 +79,20 @@ ip6_sopt_print(netdissect_options *ndo, const u_char *bp, int len)
            break;
        }
     }
-    return;
+    return 0;
 
 trunc:
-    ND_PRINT("[trunc] ");
+    return -1;
 }
 
-static void
+static int
 ip6_opt_print(netdissect_options *ndo, const u_char *bp, int len)
 {
     int i;
     int optlen = 0;
 
     if (len == 0)
-        return;
+        return 0;
     for (i = 0; i < len; i += optlen) {
        if (EXTRACT_U_1(bp + i) == IP6OPT_PAD1)
            optlen = 1;
@@ -148,9 +148,10 @@ ip6_opt_print(netdissect_options *ndo, const u_char *bp, int len)
                goto trunc;
            }
            ND_PRINT("(homeaddr: %s", ip6addr_string(ndo, bp + i + 2));
-            if (EXTRACT_U_1(bp + i + 1) > IP6OPT_HOMEADDR_MINLEN - 2) {
-               ip6_sopt_print(ndo, bp + i + IP6OPT_HOMEADDR_MINLEN,
-                               (optlen - IP6OPT_HOMEADDR_MINLEN));
+           if (EXTRACT_U_1(bp + i + 1) > IP6OPT_HOMEADDR_MINLEN - 2) {
+               if (ip6_sopt_print(ndo, bp + i + IP6OPT_HOMEADDR_MINLEN,
+                                  (optlen - IP6OPT_HOMEADDR_MINLEN)) == -1)
+                       goto trunc;
            }
             ND_PRINT(")");
            break;
@@ -164,10 +165,10 @@ ip6_opt_print(netdissect_options *ndo, const u_char *bp, int len)
        }
     }
     ND_PRINT(" ");
-    return;
+    return 0;
 
 trunc:
-    ND_PRINT("[trunc] ");
+    return -1;
 }
 
 int
@@ -182,13 +183,14 @@ hbhopt_print(netdissect_options *ndo, const u_char *bp)
     ND_TCHECK_LEN(dp, hbhlen);
     ND_PRINT("HBH ");
     if (ndo->ndo_vflag)
-       ip6_opt_print(ndo, (const u_char *)dp + sizeof(*dp), hbhlen - sizeof(*dp));
-
-    return(hbhlen);
+       if (ip6_opt_print(ndo, (const u_char *)dp + sizeof(*dp),
+                         hbhlen - sizeof(*dp)) == -1)
+           goto trunc;
+    return hbhlen;
 
-  trunc:
+trunc:
     nd_print_trunc(ndo);
-    return(-1);
+    return -1;
 }
 
 int
@@ -203,13 +205,14 @@ dstopt_print(netdissect_options *ndo, const u_char *bp)
     ND_TCHECK_LEN(dp, dstoptlen);
     ND_PRINT("DSTOPT ");
     if (ndo->ndo_vflag) {
-       ip6_opt_print(ndo, (const u_char *)dp + sizeof(*dp),
-           dstoptlen - sizeof(*dp));
+       if (ip6_opt_print(ndo, (const u_char *)dp + sizeof(*dp),
+                         dstoptlen - sizeof(*dp)) == -1)
+           goto trunc;
     }
 
-    return(dstoptlen);
+    return dstoptlen;
 
-  trunc:
+trunc:
     nd_print_trunc(ndo);
-    return(-1);
+    return -1;
 }

diff --git a/tests/cve2015-0261-crash.out b/tests/cve2015-0261-crash.out
index a2f87fea0ccac6e1a273768ffe36f9918631ac27..14dbe0726faae699b45025533c22bcf0cb59040a 100644 (file)
--- a/tests/cve2015-0261-crash.out
+++ b/tests/cve2015-0261-crash.out
@@ -1 +1 @@
-    1  05:27:12.808464432 IP6 (class 0x03, flowlabel 0x03030, hlim 48, next-header Options (0) payload length: 12336) 3030:3030:3030:3030:3030:3030:3030:3030 > 130:3030:3030:3030:3030:3030:3030:3030: HBH [trunc] (header length 8 is too small for type 1) [|mobility]
+    1  05:27:12.808464432 IP6 (class 0x03, flowlabel 0x03030, hlim 48, next-header Options (0) payload length: 12336) 3030:3030:3030:3030:3030:3030:3030:3030 > 130:3030:3030:3030:3030:3030:3030:3030: HBH  [|hbhopt]

diff --git a/tests/ipv6hdr-heapoverflow-v.out b/tests/ipv6hdr-heapoverflow-v.out
index 14cd63f223b90fe2694d0595bd9f61768d098554..87ba79d413075d7cc6464f6d178cdf46e8727e5c 100644 (file)
--- a/tests/ipv6hdr-heapoverflow-v.out
+++ b/tests/ipv6hdr-heapoverflow-v.out
@@ -1 +1 @@
-    1  05:27:12.808464432 IP6 (class 0x33, flowlabel 0x03030, hlim 48, next-header Options (0) payload length: 12336) 3030:3030:3030:3030:3030:3030:3030:3030 > 3030:3030:3030:3030:3030:3030:3030:3030: HBH [trunc]  [|hbhopt]
+    1  05:27:12.808464432 IP6 (class 0x33, flowlabel 0x03030, hlim 48, next-header Options (0) payload length: 12336) 3030:3030:3030:3030:3030:3030:3030:3030 > 3030:3030:3030:3030:3030:3030:3030:3030: HBH  [|hbhopt]