From: guy <guy>
Date: Wed, 28 Jul 2004 20:09:17 +0000 (+0000)
Subject: From Shinsuke Suzuki: fix a boundary check, and add some additional
X-Git-Url: https://git.tcpdump.org/tcpdump/commitdiff_plain/461aff7e7a31c32caa2bbff2792220bd79b56e0e

From Shinsuke Suzuki: fix a boundary check, and add some additional
boundary checks.
---

diff --git a/print-icmp6.c b/print-icmp6.c
index bd0360ba..008d2cdd 100644
--- a/print-icmp6.c
+++ b/print-icmp6.c
@@ -21,7 +21,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/tcpdump/print-icmp6.c,v 1.72.2.5 2004-06-16 00:07:31 guy Exp $";
+    "@(#) $Header: /tcpdump/master/tcpdump/print-icmp6.c,v 1.72.2.6 2004-07-28 20:09:17 guy Exp $";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -764,7 +764,7 @@ mldv2_report_print(const u_char *bp, u_int len)
 		printf(" [invalid number of groups]");
 		return;
 	    }
-            TCHECK(bp[group + 4]);
+            TCHECK2(bp[group + 4], 16);
             printf(" [gaddr %s", ip6addr_string(&bp[group + 4]));
 	    printf(" %s", tok2str(mldv2report2str, " [v2-report-#%d]",
 								bp[group]));
@@ -820,6 +820,7 @@ mldv2_query_print(const u_char *bp, u_int len)
     if (vflag) {
 	(void)printf(" [max resp delay=%d]", mrt);
     }
+    TCHECK2(bp[8], 16);
     printf(" [gaddr %s", ip6addr_string(&bp[8]));
 
     if (vflag) {
@@ -838,6 +839,7 @@ mldv2_query_print(const u_char *bp, u_int len)
 	printf(" qqi=%d", qqi);
     }
 
+    TCHECK2(bp[26], 2);
     nsrcs = ntohs(*(u_short *)&bp[26]);
     if (nsrcs > 0) {
 	if (len < 28 + nsrcs * 16)