From: Guy Harris <guy@alum.mit.edu>
Date: Thu, 23 Oct 2014 07:06:32 +0000 (-0700)
Subject: Don't run past the snapshot length when doing hex/ASCII dumps.
X-Git-Url: https://git.tcpdump.org/tcpdump/commitdiff_plain/e49c9b9fc43e93ca402ec7517aa55a27252eca92

Don't run past the snapshot length when doing hex/ASCII dumps.
---

diff --git a/print-ascii.c b/print-ascii.c
index 96410da8..3cefef33 100644
--- a/print-ascii.c
+++ b/print-ascii.c
@@ -57,8 +57,12 @@ void
 ascii_print(netdissect_options *ndo,
             const u_char *cp, u_int length)
 {
+	u_int caplength;
 	register u_char s;
 
+	caplength = (ndo->ndo_snapend >= cp) ? ndo->ndo_snapend - cp : 0;
+	if (length > caplength)
+		length = caplength;
 	ND_PRINT((ndo, "\n"));
 	while (length > 0) {
 		s = *cp++;
@@ -89,12 +93,16 @@ void
 hex_and_ascii_print_with_offset(netdissect_options *ndo, register const char *ident,
     register const u_char *cp, register u_int length, register u_int oset)
 {
+	u_int caplength;
 	register u_int i;
 	register int s1, s2;
 	register int nshorts;
 	char hexstuff[HEXDUMP_SHORTS_PER_LINE*HEXDUMP_HEXSTUFF_PER_SHORT+1], *hsp;
 	char asciistuff[ASCII_LINELENGTH+1], *asp;
 
+	caplength = (ndo->ndo_snapend >= cp) ? ndo->ndo_snapend - cp : 0;
+	if (length > caplength)
+		length = caplength;
 	nshorts = length / sizeof(u_short);
 	i = 0;
 	hsp = hexstuff; asp = asciistuff;
@@ -147,9 +155,13 @@ hex_print_with_offset(netdissect_options *ndo,
                       const char *ident, const u_char *cp, u_int length,
 		      u_int oset)
 {
+	u_int caplength;
 	register u_int i, s;
 	register int nshorts;
 
+	caplength = (ndo->ndo_snapend >= cp) ? ndo->ndo_snapend - cp : 0;
+	if (length > caplength)
+		length = caplength;
 	nshorts = (u_int) length / sizeof(u_short);
 	i = 0;
 	while (--nshorts >= 0) {
diff --git a/tcpdump.c b/tcpdump.c
index 8d615d74..48c47000 100644
--- a/tcpdump.c
+++ b/tcpdump.c
@@ -2303,7 +2303,8 @@ print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
 	/*
 	 * Some printers want to check that they're not walking off the
 	 * end of the packet.
-	 * Rather than pass it all the way down, we set this global.
+	 * Rather than pass it all the way down, we set this member
+	 * of the netdissect_options structure.
 	 */
 	ndo->ndo_snapend = sp + h->caplen;
 
@@ -2313,6 +2314,11 @@ print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
                 hdrlen = (*print_info->p.printer)(h, sp);
         }
 
+	/*
+	 * Restore the original snapend, as a printer might have
+	 * changed it.
+	 */
+	ndo->ndo_snapend = sp + h->caplen;
 	if (ndo->ndo_Xflag) {
 		/*
 		 * Print the raw packet data in hex and ASCII.