RSVP: Fix an infinite loop

diff --git a/print-rsvp.c b/print-rsvp.c
index 6c807fe71b865e36d6053c4a3febd0cd2ed11531..1a4dd422d27d733564f2854ccb9591ac50161391 100644 (file)
--- a/print-rsvp.c
+++ b/print-rsvp.c
@@ -29,6 +29,8 @@
 #include "af.h"
 #include "signature.h"
 
 #include "af.h"
 #include "signature.h"
 

+static const char istr[] = " (invalid)";
+

 /*
  * RFC 2205 common header
  *
 /*
  * RFC 2205 common header
  *


@@ -1170,6 +1172,9 @@ _U_
                            tok2str(af_values, "Unknown", af), af,
                            subobj_len));
 
                            tok2str(af_values, "Unknown", af), af,
                            subobj_len));
 

+                    if(subobj_len == 0)
+                        goto invalid;
+

                     switch(subobj_type) {
                     case RSVP_GEN_UNI_SUBOBJ_SOURCE_TNA_ADDRESS:
                     case RSVP_GEN_UNI_SUBOBJ_DESTINATION_TNA_ADDRESS:
                     switch(subobj_type) {
                     case RSVP_GEN_UNI_SUBOBJ_SOURCE_TNA_ADDRESS:
                     case RSVP_GEN_UNI_SUBOBJ_DESTINATION_TNA_ADDRESS:


@@ -1769,6 +1774,9 @@ _U_
         tlen-=rsvp_obj_len;
     }
     return 0;
         tlen-=rsvp_obj_len;
     }
     return 0;

+invalid:
+    ND_PRINT((ndo, "%s", istr));
+    return -1;

 trunc:
     ND_PRINT((ndo, "\n\t\t packet exceeded snapshot"));
     return -1;
 trunc:
     ND_PRINT((ndo, "\n\t\t packet exceeded snapshot"));
     return -1;