|
 |
ac9b3d |
From 009b632b5c7cf5151699b660a4c885ba57f9f836 Mon Sep 17 00:00:00 2001
|
|
|
ac9b3d |
From: Guy Harris <guy@alum.mit.edu>
|
|
|
ac9b3d |
Date: Thu, 14 Aug 2014 17:14:32 -0700
|
|
|
ac9b3d |
Subject: [PATCH 3/4] Check for TLV length too small.
|
|
|
ac9b3d |
|
|
|
ac9b3d |
The TLV length includes the T and the L, so it must be at least 4.
|
|
|
ac9b3d |
|
|
|
ac9b3d |
This means we don't need the "avoid infinite loop" check later; that
|
|
|
ac9b3d |
check was wrong, as per GitHub issue #401 and #402; this fixes #402,
|
|
|
ac9b3d |
which has a different patch for that bug.
|
|
|
ac9b3d |
|
|
|
ac9b3d |
(cherry picked from commit 5511e8f79f0ac96671bab23223397881eba8b806)
|
|
|
ac9b3d |
|
|
|
ac9b3d |
[msekleta: replaced ND_PRINT by printfs]
|
|
|
ac9b3d |
---
|
|
|
ac9b3d |
print-cdp.c | 18 +++++++++++++++---
|
|
|
ac9b3d |
1 file changed, 15 insertions(+), 3 deletions(-)
|
|
|
ac9b3d |
|
|
|
ac9b3d |
diff --git a/print-cdp.c b/print-cdp.c
|
|
|
ac9b3d |
index 152b2f9..5a0eaea 100644
|
|
|
ac9b3d |
--- a/print-cdp.c
|
|
|
ac9b3d |
+++ b/print-cdp.c
|
|
|
ac9b3d |
@@ -111,6 +111,21 @@ cdp_print(const u_char *pptr, u_int length, u_int caplen)
|
|
|
ac9b3d |
goto trunc;
|
|
|
ac9b3d |
type = EXTRACT_16BITS(tptr);
|
|
|
ac9b3d |
len = EXTRACT_16BITS(tptr+2); /* object length includes the 4 bytes header length */
|
|
|
ac9b3d |
+
|
|
|
ac9b3d |
+ if (len < 4) {
|
|
|
ac9b3d |
+ if (vflag)
|
|
|
ac9b3d |
+ printf("\n\t%s (0x%02x), length: %u byte%s (too short)",
|
|
|
ac9b3d |
+ tok2str(cdp_tlv_values,"unknown field type", type),
|
|
|
ac9b3d |
+ type,
|
|
|
ac9b3d |
+ len,
|
|
|
ac9b3d |
+ PLURAL_SUFFIX(len)); /* plural */
|
|
|
ac9b3d |
+ else
|
|
|
ac9b3d |
+ printf(", %s TLV length %u too short",
|
|
|
ac9b3d |
+ tok2str(cdp_tlv_values,"unknown field type", type),
|
|
|
ac9b3d |
+ len);
|
|
|
ac9b3d |
+ break;
|
|
|
ac9b3d |
+ }
|
|
|
ac9b3d |
+
|
|
|
ac9b3d |
tptr += 4;
|
|
|
ac9b3d |
len -= 4;
|
|
|
ac9b3d |
|
|
|
ac9b3d |
@@ -222,9 +237,6 @@ cdp_print(const u_char *pptr, u_int length, u_int caplen)
|
|
|
ac9b3d |
break;
|
|
|
ac9b3d |
}
|
|
|
ac9b3d |
}
|
|
|
ac9b3d |
- /* avoid infinite loop */
|
|
|
ac9b3d |
- if (len == 0)
|
|
|
ac9b3d |
- break;
|
|
|
ac9b3d |
tptr = tptr+len;
|
|
|
ac9b3d |
}
|
|
|
ac9b3d |
if (vflag < 1)
|
|
|
ac9b3d |
--
|
|
|
ac9b3d |
2.4.3
|
|
|
ac9b3d |
|