]> The Tcpdump Group git mirrors - tcpdump/commitdiff
juniper: don't do bounds checking for fields in the cookie.
authorGuy Harris <[email protected]>
Thu, 21 Jul 2022 08:32:44 +0000 (01:32 -0700)
committerGuy Harris <[email protected]>
Thu, 21 Jul 2022 08:32:44 +0000 (01:32 -0700)
l2info.cookie is not inside the packet - it's a copy of data from the
packet, with the copy doing the necessary bounds checking - so we
shouldn't use NT_TCHECK or GET macros on it.

print-juniper.c

index c02de78e6e1bed6d1b48c1baf71366941b08fa14..48b8a35521404d1b0fc09c4f9a9c42afe0419223 100644 (file)
@@ -495,13 +495,13 @@ juniper_ggsn_if_print(netdissect_options *ndo,
         p+=l2info.header_len;
         gh = (struct juniper_ggsn_header *)&l2info.cookie;
 
         p+=l2info.header_len;
         gh = (struct juniper_ggsn_header *)&l2info.cookie;
 
-        ND_TCHECK_SIZE(gh);
-        proto = GET_U_1(gh->proto);
+        /* use EXTRACT_, not GET_ (not packet buffer pointer) */
+        proto = EXTRACT_U_1(gh->proto);
         if (ndo->ndo_eflag) {
             ND_PRINT("proto %s (%u), vlan %u: ",
                    tok2str(juniper_protocol_values,"Unknown",proto),
                    proto,
         if (ndo->ndo_eflag) {
             ND_PRINT("proto %s (%u), vlan %u: ",
                    tok2str(juniper_protocol_values,"Unknown",proto),
                    proto,
-                   GET_BE_U_2(gh->vlan_id));
+                   EXTRACT_BE_U_2(gh->vlan_id));
         }
 
         switch (proto) {
         }
 
         switch (proto) {