From: Guy Harris <guy@alum.mit.edu>
Date: Sun, 21 Feb 2010 19:27:41 +0000 (-0800)
Subject: Don't directly fetch multi-byte integers from packets.
X-Git-Tag: tcpdump-4.1.0~11
X-Git-Url: https://git.tcpdump.org/tcpdump/commitdiff_plain/623e4271b0464e7d17f3626f6387a70cd103a748

Don't directly fetch multi-byte integers from packets.

Use the EXTRACT_ macros to extract multi-byte integral values from
packets, rather than just dereferencing pointers into the packet; there
is no guarantee that the packet data will be aligned on the right
boundary, and there is no guarantee that, if they're not, a direct
access will work correctly.
---

diff --git a/token.h b/token.h
index b1d92a3f..73a82711 100644
--- a/token.h
+++ b/token.h
@@ -34,12 +34,12 @@
 #define FRAME_TYPE(trp)		(((trp)->token_fc & 0xC0) >> 6)
 #define TOKEN_FC_LLC		1
 
-#define BROADCAST(trp)		((ntohs((trp)->token_rcf) & 0xE000) >> 13)
-#define RIF_LENGTH(trp)		((ntohs((trp)->token_rcf) & 0x1f00) >> 8)
-#define DIRECTION(trp)		((ntohs((trp)->token_rcf) & 0x0080) >> 7)
-#define LARGEST_FRAME(trp)	((ntohs((trp)->token_rcf) & 0x0070) >> 4)
-#define RING_NUMBER(trp, x)	((ntohs((trp)->token_rseg[x]) & 0xfff0) >> 4)
-#define BRIDGE_NUMBER(trp, x)	((ntohs((trp)->token_rseg[x]) & 0x000f))
+#define BROADCAST(trp)		((EXTRACT_16BITS(&(trp)->token_rcf) & 0xE000) >> 13)
+#define RIF_LENGTH(trp)		((EXTRACT_16BITS(&(trp)->token_rcf) & 0x1f00) >> 8)
+#define DIRECTION(trp)		((EXTRACT_16BITS(&(trp)->token_rcf) & 0x0080) >> 7)
+#define LARGEST_FRAME(trp)	((EXTRACT_16BITS(&(trp)->token_rcf) & 0x0070) >> 4)
+#define RING_NUMBER(trp, x)	((EXTRACT_16BITS(&(trp)->token_rseg[x]) & 0xfff0) >> 4)
+#define BRIDGE_NUMBER(trp, x)	((EXTRACT_16BITS(&(trp)->token_rseg[x]) & 0x000f))
 #define SEGMENT_COUNT(trp)	((int)((RIF_LENGTH(trp) - 2) / 2))
 
 struct token_header {