From: Martin Buck <mb-tmp-tvguho.pbz@gromit.dyndns.org>
Date: Tue, 16 May 2017 09:18:13 +0000 (+0200)
Subject: Don't print "bad length" for fragmented UDP packets
X-Git-Tag: tcpdump-4.99-bp~386^2~1
X-Git-Url: https://git.tcpdump.org/tcpdump/commitdiff_plain/8bf3f34b563bf6e7fbfc03873b20703c47612ea9

Don't print "bad length" for fragmented UDP packets

In case of fragmentation, it's perfectly OK for the total UDP length to be
larger than the length of the first packet, so don't raise a false alert.

Signed-off-by: Martin Buck <mb-tmp-tvguho.pbz@gromit.dyndns.org>
---

diff --git a/print-udp.c b/print-udp.c
index 5a74ff2f..b4e8271d 100644
--- a/print-udp.c
+++ b/print-udp.c
@@ -690,14 +690,14 @@ udp_print(netdissect_options *ndo, register const u_char *bp, u_int length,
 				ND_PRINT((ndo, "kip "));
 			llap_print(ndo, cp, length);
 		} else {
-			if (ulen > length)
+			if (ulen > length && !fragmented)
 				ND_PRINT((ndo, "UDP, bad length %u > %u",
 				    ulen, length));
 			else
 				ND_PRINT((ndo, "UDP, length %u", ulen));
 		}
 	} else {
-		if (ulen > length)
+		if (ulen > length && !fragmented)
 			ND_PRINT((ndo, "UDP, bad length %u > %u",
 			    ulen, length));
 		else