MFV r285191: tcpdump 4.7.4.

Also, the changes made in r272451 and r272653 that were lost in the
merge of 4.6.2 (r276788) have been restored.

PR: 199568
Differential Revision: https://reviews.freebsd.org/D3007
Reviewed by: brooks, hiren
Approved by: jmallett (mentor)
MFC after: 1 month

1 files changed, 223 insertions, 258 deletions

diff --git a/contrib/tcpdump/print-aodv.c b/contrib/tcpdump/print-aodv.c
index 093e174..ef27eee 100644
--- a/contrib/tcpdump/print-aodv.c
+++ b/contrib/tcpdump/print-aodv.c
@@ -37,9 +37,6 @@
 
 #include <tcpdump-stdinc.h>
 
-/* for offsetof */
-#include <stddef.h>
-
 #include "interface.h"
 #include "addrtoname.h"
 #include "extract.h"			/* must come after interface.h */
@@ -146,13 +143,6 @@ struct aodv_rerr {
 	uint8_t		rerr_flags;	/* various flags */
 	uint8_t		rerr_zero0;	/* reserved, set to zero */
 	uint8_t		rerr_dc;	/* destination count */
-	union {
-		struct	rerr_unreach dest[1];
-#ifdef INET6
-		struct	rerr_unreach6 dest6[1];
-		struct	rerr_unreach6_draft_01 dest6_draft_01[1];
-#endif
-	} r;
 };
 
 #define RERR_NODELETE		0x80	/* don't delete the link */
@@ -163,19 +153,6 @@ struct aodv_rrep_ack {
 	uint8_t		ra_zero0;
 };
 
-union aodv {
-	struct aodv_rreq rreq;
-	struct aodv_rrep rrep;
-	struct aodv_rerr rerr;
-	struct aodv_rrep_ack rrep_ack;
-#ifdef INET6
-	struct aodv_rreq6 rreq6;
-	struct aodv_rreq6_draft_01 rreq6_draft_01;
-	struct aodv_rrep6 rrep6;
-	struct aodv_rrep6_draft_01 rrep6_draft_01;
-#endif
-};
-
 #define	AODV_RREQ		1	/* route request */
 #define	AODV_RREP		2	/* route response */
 #define	AODV_RERR		3	/* error report */
@@ -204,22 +181,14 @@ static void
 aodv_extension(netdissect_options *ndo,
                const struct aodv_ext *ep, u_int length)
 {
-	u_int i;
 	const struct aodv_hello *ah;
 
 	switch (ep->type) {
 	case AODV_EXT_HELLO:
-		if (ndo->ndo_snapend < (u_char *) ep) {
-			ND_PRINT((ndo, " [|hello]"));
-			return;
-		}
-		i = min(length, (u_int)(ndo->ndo_snapend - (u_char *)ep));
-		if (i < sizeof(struct aodv_hello)) {
-			ND_PRINT((ndo, " [|hello]"));
-			return;
-		}
-		i -= sizeof(struct aodv_hello);
-		ah = (void *)ep;
+		ah = (const struct aodv_hello *)(const void *)ep;
+		ND_TCHECK(*ah);
+		if (length < sizeof(struct aodv_hello))
+			goto trunc;
 		ND_PRINT((ndo, "\n\text HELLO %ld ms",
 		    (unsigned long)EXTRACT_32BITS(&ah->interval)));
 		break;
@@ -228,141 +197,135 @@ aodv_extension(netdissect_options *ndo,
 		ND_PRINT((ndo, "\n\text %u %u", ep->type, ep->length));
 		break;
 	}
+	return;
+
+trunc:
+	ND_PRINT((ndo, " [|hello]"));
 }
 
 static void
-aodv_rreq(netdissect_options *ndo,
-          const union aodv *ap, const u_char *dat, u_int length)
+aodv_rreq(netdissect_options *ndo, const u_char *dat, u_int length)
 {
 	u_int i;
+	const struct aodv_rreq *ap = (const struct aodv_rreq *)dat;
 
-	if (ndo->ndo_snapend < dat) {
-		ND_PRINT((ndo, " [|aodv]"));
-		return;
-	}
-	i = min(length, (u_int)(ndo->ndo_snapend - dat));
-	if (i < sizeof(ap->rreq)) {
-		ND_PRINT((ndo, " [|rreq]"));
-		return;
-	}
-	i -= sizeof(ap->rreq);
+	ND_TCHECK(*ap);
+	if (length < sizeof(*ap))
+		goto trunc;
 	ND_PRINT((ndo, " rreq %u %s%s%s%s%shops %u id 0x%08lx\n"
 	    "\tdst %s seq %lu src %s seq %lu", length,
-	    ap->rreq.rreq_type & RREQ_JOIN ? "[J]" : "",
-	    ap->rreq.rreq_type & RREQ_REPAIR ? "[R]" : "",
-	    ap->rreq.rreq_type & RREQ_GRAT ? "[G]" : "",
-	    ap->rreq.rreq_type & RREQ_DEST ? "[D]" : "",
-	    ap->rreq.rreq_type & RREQ_UNKNOWN ? "[U] " : " ",
-	    ap->rreq.rreq_hops,
-	    (unsigned long)EXTRACT_32BITS(&ap->rreq.rreq_id),
-	    ipaddr_string(ndo, &ap->rreq.rreq_da),
-	    (unsigned long)EXTRACT_32BITS(&ap->rreq.rreq_ds),
-	    ipaddr_string(ndo, &ap->rreq.rreq_oa),
-	    (unsigned long)EXTRACT_32BITS(&ap->rreq.rreq_os)));
+	    ap->rreq_type & RREQ_JOIN ? "[J]" : "",
+	    ap->rreq_type & RREQ_REPAIR ? "[R]" : "",
+	    ap->rreq_type & RREQ_GRAT ? "[G]" : "",
+	    ap->rreq_type & RREQ_DEST ? "[D]" : "",
+	    ap->rreq_type & RREQ_UNKNOWN ? "[U] " : " ",
+	    ap->rreq_hops,
+	    (unsigned long)EXTRACT_32BITS(&ap->rreq_id),
+	    ipaddr_string(ndo, &ap->rreq_da),
+	    (unsigned long)EXTRACT_32BITS(&ap->rreq_ds),
+	    ipaddr_string(ndo, &ap->rreq_oa),
+	    (unsigned long)EXTRACT_32BITS(&ap->rreq_os)));
+	i = length - sizeof(*ap);
 	if (i >= sizeof(struct aodv_ext))
-		aodv_extension(ndo, (void *)(&ap->rreq + 1), i);
+		aodv_extension(ndo, (const struct aodv_ext *)(dat + sizeof(*ap)), i);
+	return;
+
+trunc:
+	ND_PRINT((ndo, " [|rreq"));
 }
 
 static void
-aodv_rrep(netdissect_options *ndo,
-          const union aodv *ap, const u_char *dat, u_int length)
+aodv_rrep(netdissect_options *ndo, const u_char *dat, u_int length)
 {
 	u_int i;
+	const struct aodv_rrep *ap = (const struct aodv_rrep *)dat;
 
-	if (ndo->ndo_snapend < dat) {
-		ND_PRINT((ndo, " [|aodv]"));
-		return;
-	}
-	i = min(length, (u_int)(ndo->ndo_snapend - dat));
-	if (i < sizeof(ap->rrep)) {
-		ND_PRINT((ndo, " [|rrep]"));
-		return;
-	}
-	i -= sizeof(ap->rrep);
+	ND_TCHECK(*ap);
+	if (length < sizeof(*ap))
+		goto trunc;
 	ND_PRINT((ndo, " rrep %u %s%sprefix %u hops %u\n"
 	    "\tdst %s dseq %lu src %s %lu ms", length,
-	    ap->rrep.rrep_type & RREP_REPAIR ? "[R]" : "",
-	    ap->rrep.rrep_type & RREP_ACK ? "[A] " : " ",
-	    ap->rrep.rrep_ps & RREP_PREFIX_MASK,
-	    ap->rrep.rrep_hops,
-	    ipaddr_string(ndo, &ap->rrep.rrep_da),
-	    (unsigned long)EXTRACT_32BITS(&ap->rrep.rrep_ds),
-	    ipaddr_string(ndo, &ap->rrep.rrep_oa),
-	    (unsigned long)EXTRACT_32BITS(&ap->rrep.rrep_life)));
+	    ap->rrep_type & RREP_REPAIR ? "[R]" : "",
+	    ap->rrep_type & RREP_ACK ? "[A] " : " ",
+	    ap->rrep_ps & RREP_PREFIX_MASK,
+	    ap->rrep_hops,
+	    ipaddr_string(ndo, &ap->rrep_da),
+	    (unsigned long)EXTRACT_32BITS(&ap->rrep_ds),
+	    ipaddr_string(ndo, &ap->rrep_oa),
+	    (unsigned long)EXTRACT_32BITS(&ap->rrep_life)));
+	i = length - sizeof(*ap);
 	if (i >= sizeof(struct aodv_ext))
-		aodv_extension(ndo, (void *)(&ap->rrep + 1), i);
+		aodv_extension(ndo, (const struct aodv_ext *)(dat + sizeof(*ap)), i);
+	return;
+
+trunc:
+	ND_PRINT((ndo, " [|rreq"));
 }
 
 static void
-aodv_rerr(netdissect_options *ndo,
-          const union aodv *ap, const u_char *dat, u_int length)
+aodv_rerr(netdissect_options *ndo, const u_char *dat, u_int length)
 {
-	u_int i;
-	const struct rerr_unreach *dp = NULL;
-	int n, trunc;
+	u_int i, dc;
+	const struct aodv_rerr *ap = (const struct aodv_rerr *)dat;
+	const struct rerr_unreach *dp;
 
-	if (ndo->ndo_snapend < dat) {
-		ND_PRINT((ndo, " [|aodv]"));
-		return;
-	}
-	i = min(length, (u_int)(ndo->ndo_snapend - dat));
-	if (i < offsetof(struct aodv_rerr, r)) {
-		ND_PRINT((ndo, " [|rerr]"));
-		return;
-	}
-	i -= offsetof(struct aodv_rerr, r);
-	dp = &ap->rerr.r.dest[0];
-	n = ap->rerr.rerr_dc * sizeof(ap->rerr.r.dest[0]);
+	ND_TCHECK(*ap);
+	if (length < sizeof(*ap))
+		goto trunc;
 	ND_PRINT((ndo, " rerr %s [items %u] [%u]:",
-	    ap->rerr.rerr_flags & RERR_NODELETE ? "[D]" : "",
-	    ap->rerr.rerr_dc, length));
-	trunc = n - (i/sizeof(ap->rerr.r.dest[0]));
-	for (; i >= sizeof(ap->rerr.r.dest[0]);
-	    ++dp, i -= sizeof(ap->rerr.r.dest[0])) {
+	    ap->rerr_flags & RERR_NODELETE ? "[D]" : "",
+	    ap->rerr_dc, length));
+	dp = (struct rerr_unreach *)(dat + sizeof(*ap));
+	i = length - sizeof(*ap);
+	for (dc = ap->rerr_dc; dc != 0; dc--) {
+		ND_TCHECK(*dp);
+		if (i < sizeof(*dp))
+			goto trunc;
 		ND_PRINT((ndo, " {%s}(%ld)", ipaddr_string(ndo, &dp->u_da),
 		    (unsigned long)EXTRACT_32BITS(&dp->u_ds)));
+		dp++;
+		i -= sizeof(*dp);
 	}
-	if (trunc)
-		ND_PRINT((ndo, "[|rerr]"));
+	return;
+
+trunc:
+	ND_PRINT((ndo, "[|rerr]"));
 }
 
 static void
 #ifdef INET6
-aodv_v6_rreq(netdissect_options *ndo,
-             const union aodv *ap, const u_char *dat, u_int length)
+aodv_v6_rreq(netdissect_options *ndo, const u_char *dat, u_int length)
 #else
-aodv_v6_rreq(netdissect_options *ndo,
-             const union aodv *ap _U_, const u_char *dat _U_, u_int length)
+aodv_v6_rreq(netdissect_options *ndo, const u_char *dat _U_, u_int length)
 #endif
 {
 #ifdef INET6
 	u_int i;
+	const struct aodv_rreq6 *ap = (const struct aodv_rreq6 *)dat;
 
-	if (ndo->ndo_snapend < dat) {
-		ND_PRINT((ndo, " [|aodv]"));
-		return;
-	}
-	i = min(length, (u_int)(ndo->ndo_snapend - dat));
-	if (i < sizeof(ap->rreq6)) {
-		ND_PRINT((ndo, " [|rreq6]"));
-		return;
-	}
-	i -= sizeof(ap->rreq6);
+	ND_TCHECK(*ap);
+	if (length < sizeof(*ap))
+		goto trunc;
 	ND_PRINT((ndo, " v6 rreq %u %s%s%s%s%shops %u id 0x%08lx\n"
 	    "\tdst %s seq %lu src %s seq %lu", length,
-	    ap->rreq6.rreq_type & RREQ_JOIN ? "[J]" : "",
-	    ap->rreq6.rreq_type & RREQ_REPAIR ? "[R]" : "",
-	    ap->rreq6.rreq_type & RREQ_GRAT ? "[G]" : "",
-	    ap->rreq6.rreq_type & RREQ_DEST ? "[D]" : "",
-	    ap->rreq6.rreq_type & RREQ_UNKNOWN ? "[U] " : " ",
-	    ap->rreq6.rreq_hops,
-	    (unsigned long)EXTRACT_32BITS(&ap->rreq6.rreq_id),
-	    ip6addr_string(ndo, &ap->rreq6.rreq_da),
-	    (unsigned long)EXTRACT_32BITS(&ap->rreq6.rreq_ds),
-	    ip6addr_string(ndo, &ap->rreq6.rreq_oa),
-	    (unsigned long)EXTRACT_32BITS(&ap->rreq6.rreq_os)));
+	    ap->rreq_type & RREQ_JOIN ? "[J]" : "",
+	    ap->rreq_type & RREQ_REPAIR ? "[R]" : "",
+	    ap->rreq_type & RREQ_GRAT ? "[G]" : "",
+	    ap->rreq_type & RREQ_DEST ? "[D]" : "",
+	    ap->rreq_type & RREQ_UNKNOWN ? "[U] " : " ",
+	    ap->rreq_hops,
+	    (unsigned long)EXTRACT_32BITS(&ap->rreq_id),
+	    ip6addr_string(ndo, &ap->rreq_da),
+	    (unsigned long)EXTRACT_32BITS(&ap->rreq_ds),
+	    ip6addr_string(ndo, &ap->rreq_oa),
+	    (unsigned long)EXTRACT_32BITS(&ap->rreq_os)));
+	i = length - sizeof(*ap);
 	if (i >= sizeof(struct aodv_ext))
-		aodv_extension(ndo, (void *)(&ap->rreq6 + 1), i);
+		aodv_extension(ndo, (const struct aodv_ext *)(dat + sizeof(*ap)), i);
+	return;
+
+trunc:
+	ND_PRINT((ndo, " [|rreq"));
 #else
 	ND_PRINT((ndo, " v6 rreq %u", length));
 #endif
@@ -370,38 +333,35 @@ aodv_v6_rreq(netdissect_options *ndo,
 
 static void
 #ifdef INET6
-aodv_v6_rrep(netdissect_options *ndo,
-             const union aodv *ap, const u_char *dat, u_int length)
+aodv_v6_rrep(netdissect_options *ndo, const u_char *dat, u_int length)
 #else
-aodv_v6_rrep(netdissect_options *ndo,
-             const union aodv *ap _U_, const u_char *dat _U_, u_int length)
+aodv_v6_rrep(netdissect_options *ndo, const u_char *dat _U_, u_int length)
 #endif
 {
 #ifdef INET6
 	u_int i;
+	const struct aodv_rrep6 *ap = (const struct aodv_rrep6 *)dat;
 
-	if (ndo->ndo_snapend < dat) {
-		ND_PRINT((ndo, " [|aodv]"));
-		return;
-	}
-	i = min(length, (u_int)(ndo->ndo_snapend - dat));
-	if (i < sizeof(ap->rrep6)) {
-		ND_PRINT((ndo, " [|rrep6]"));
-		return;
-	}
-	i -= sizeof(ap->rrep6);
+	ND_TCHECK(*ap);
+	if (length < sizeof(*ap))
+		goto trunc;
 	ND_PRINT((ndo, " rrep %u %s%sprefix %u hops %u\n"
 	   "\tdst %s dseq %lu src %s %lu ms", length,
-	    ap->rrep6.rrep_type & RREP_REPAIR ? "[R]" : "",
-	    ap->rrep6.rrep_type & RREP_ACK ? "[A] " : " ",
-	    ap->rrep6.rrep_ps & RREP_PREFIX_MASK,
-	    ap->rrep6.rrep_hops,
-	    ip6addr_string(ndo, &ap->rrep6.rrep_da),
-	    (unsigned long)EXTRACT_32BITS(&ap->rrep6.rrep_ds),
-	    ip6addr_string(ndo, &ap->rrep6.rrep_oa),
-	    (unsigned long)EXTRACT_32BITS(&ap->rrep6.rrep_life)));
+	    ap->rrep_type & RREP_REPAIR ? "[R]" : "",
+	    ap->rrep_type & RREP_ACK ? "[A] " : " ",
+	    ap->rrep_ps & RREP_PREFIX_MASK,
+	    ap->rrep_hops,
+	    ip6addr_string(ndo, &ap->rrep_da),
+	    (unsigned long)EXTRACT_32BITS(&ap->rrep_ds),
+	    ip6addr_string(ndo, &ap->rrep_oa),
+	    (unsigned long)EXTRACT_32BITS(&ap->rrep_life)));
+	i = length - sizeof(*ap);
 	if (i >= sizeof(struct aodv_ext))
-		aodv_extension(ndo, (void *)(&ap->rrep6 + 1), i);
+		aodv_extension(ndo, (const struct aodv_ext *)(dat + sizeof(*ap)), i);
+	return;
+
+trunc:
+	ND_PRINT((ndo, " [|rreq"));
 #else
 	ND_PRINT((ndo, " rrep %u", length));
 #endif
@@ -409,31 +369,37 @@ aodv_v6_rrep(netdissect_options *ndo,
 
 static void
 #ifdef INET6
-aodv_v6_rerr(netdissect_options *ndo,
-             const union aodv *ap, u_int length)
+aodv_v6_rerr(netdissect_options *ndo, const u_char *dat, u_int length)
 #else
-aodv_v6_rerr(netdissect_options *ndo,
-             const union aodv *ap _U_, u_int length)
+aodv_v6_rerr(netdissect_options *ndo, const u_char *dat _U_, u_int length)
 #endif
 {
 #ifdef INET6
-	const struct rerr_unreach6 *dp6 = NULL;
-	int i, j, n, trunc;
+	u_int i, dc;
+	const struct aodv_rerr *ap = (const struct aodv_rerr *)dat;
+	const struct rerr_unreach6 *dp6;
 
-	i = length - offsetof(struct aodv_rerr, r);
-	j = sizeof(ap->rerr.r.dest6[0]);
-	dp6 = &ap->rerr.r.dest6[0];
-	n = ap->rerr.rerr_dc * j;
+	ND_TCHECK(*ap);
+	if (length < sizeof(*ap))
+		goto trunc;
 	ND_PRINT((ndo, " rerr %s [items %u] [%u]:",
-	    ap->rerr.rerr_flags & RERR_NODELETE ? "[D]" : "",
-	    ap->rerr.rerr_dc, length));
-	trunc = n - (i/j);
-	for (; i -= j >= 0; ++dp6) {
+	    ap->rerr_flags & RERR_NODELETE ? "[D]" : "",
+	    ap->rerr_dc, length));
+	dp6 = (struct rerr_unreach6 *)(void *)(ap + 1);
+	i = length - sizeof(*ap);
+	for (dc = ap->rerr_dc; dc != 0; dc--) {
+		ND_TCHECK(*dp6);
+		if (i < sizeof(*dp6))
+			goto trunc;
 		ND_PRINT((ndo, " {%s}(%ld)", ip6addr_string(ndo, &dp6->u_da),
 		    (unsigned long)EXTRACT_32BITS(&dp6->u_ds)));
+		dp6++;
+		i -= sizeof(*dp6);
 	}
-	if (trunc)
-		ND_PRINT((ndo, "[|rerr]"));
+	return;
+
+trunc:
+	ND_PRINT((ndo, "[|rerr]"));
 #else
 	ND_PRINT((ndo, " rerr %u", length));
 #endif
@@ -441,42 +407,38 @@ aodv_v6_rerr(netdissect_options *ndo,
 
 static void
 #ifdef INET6
-aodv_v6_draft_01_rreq(netdissect_options *ndo,
-                      const union aodv *ap, const u_char *dat, u_int length)
+aodv_v6_draft_01_rreq(netdissect_options *ndo, const u_char *dat, u_int length)
 #else
-aodv_v6_draft_01_rreq(netdissect_options *ndo,
-                      const union aodv *ap _U_, const u_char *dat _U_,
-    u_int length)
+aodv_v6_draft_01_rreq(netdissect_options *ndo, const u_char *dat _U_, u_int length)
 #endif
 {
 #ifdef INET6
 	u_int i;
+	const struct aodv_rreq6_draft_01 *ap = (const struct aodv_rreq6_draft_01 *)dat;
 
-	if (ndo->ndo_snapend < dat) {
-		ND_PRINT((ndo, " [|aodv]"));
-		return;
-	}
-	i = min(length, (u_int)(ndo->ndo_snapend - dat));
-	if (i < sizeof(ap->rreq6_draft_01)) {
-		ND_PRINT((ndo, " [|rreq6]"));
-		return;
-	}
-	i -= sizeof(ap->rreq6_draft_01);
+	ND_TCHECK(*ap);
+	if (length < sizeof(*ap))
+		goto trunc;
 	ND_PRINT((ndo, " rreq %u %s%s%s%s%shops %u id 0x%08lx\n"
 	    "\tdst %s seq %lu src %s seq %lu", length,
-	    ap->rreq6_draft_01.rreq_type & RREQ_JOIN ? "[J]" : "",
-	    ap->rreq6_draft_01.rreq_type & RREQ_REPAIR ? "[R]" : "",
-	    ap->rreq6_draft_01.rreq_type & RREQ_GRAT ? "[G]" : "",
-	    ap->rreq6_draft_01.rreq_type & RREQ_DEST ? "[D]" : "",
-	    ap->rreq6_draft_01.rreq_type & RREQ_UNKNOWN ? "[U] " : " ",
-	    ap->rreq6_draft_01.rreq_hops,
-	    (unsigned long)EXTRACT_32BITS(&ap->rreq6_draft_01.rreq_id),
-	    ip6addr_string(ndo, &ap->rreq6_draft_01.rreq_da),
-	    (unsigned long)EXTRACT_32BITS(&ap->rreq6_draft_01.rreq_ds),
-	    ip6addr_string(ndo, &ap->rreq6_draft_01.rreq_oa),
-	    (unsigned long)EXTRACT_32BITS(&ap->rreq6_draft_01.rreq_os)));
+	    ap->rreq_type & RREQ_JOIN ? "[J]" : "",
+	    ap->rreq_type & RREQ_REPAIR ? "[R]" : "",
+	    ap->rreq_type & RREQ_GRAT ? "[G]" : "",
+	    ap->rreq_type & RREQ_DEST ? "[D]" : "",
+	    ap->rreq_type & RREQ_UNKNOWN ? "[U] " : " ",
+	    ap->rreq_hops,
+	    (unsigned long)EXTRACT_32BITS(&ap->rreq_id),
+	    ip6addr_string(ndo, &ap->rreq_da),
+	    (unsigned long)EXTRACT_32BITS(&ap->rreq_ds),
+	    ip6addr_string(ndo, &ap->rreq_oa),
+	    (unsigned long)EXTRACT_32BITS(&ap->rreq_os)));
+	i = length - sizeof(*ap);
 	if (i >= sizeof(struct aodv_ext))
-		aodv_extension(ndo, (void *)(&ap->rreq6_draft_01 + 1), i);
+		aodv_extension(ndo, (const struct aodv_ext *)(dat + sizeof(*ap)), i);
+	return;
+
+trunc:
+	ND_PRINT((ndo, " [|rreq"));
 #else
 	ND_PRINT((ndo, " rreq %u", length));
 #endif
@@ -484,39 +446,35 @@ aodv_v6_draft_01_rreq(netdissect_options *ndo,
 
 static void
 #ifdef INET6
-aodv_v6_draft_01_rrep(netdissect_options *ndo,
-                      const union aodv *ap, const u_char *dat, u_int length)
+aodv_v6_draft_01_rrep(netdissect_options *ndo, const u_char *dat, u_int length)
 #else
-aodv_v6_draft_01_rrep(netdissect_options *ndo,
-                      const union aodv *ap _U_, const u_char *dat _U_,
-    u_int length)
+aodv_v6_draft_01_rrep(netdissect_options *ndo, const u_char *dat _U_, u_int length)
 #endif
 {
 #ifdef INET6
 	u_int i;
+	const struct aodv_rrep6_draft_01 *ap = (const struct aodv_rrep6_draft_01 *)dat;
 
-	if (ndo->ndo_snapend < dat) {
-		ND_PRINT((ndo, " [|aodv]"));
-		return;
-	}
-	i = min(length, (u_int)(ndo->ndo_snapend - dat));
-	if (i < sizeof(ap->rrep6_draft_01)) {
-		ND_PRINT((ndo, " [|rrep6]"));
-		return;
-	}
-	i -= sizeof(ap->rrep6_draft_01);
+	ND_TCHECK(*ap);
+	if (length < sizeof(*ap))
+		goto trunc;
 	ND_PRINT((ndo, " rrep %u %s%sprefix %u hops %u\n"
 	   "\tdst %s dseq %lu src %s %lu ms", length,
-	    ap->rrep6_draft_01.rrep_type & RREP_REPAIR ? "[R]" : "",
-	    ap->rrep6_draft_01.rrep_type & RREP_ACK ? "[A] " : " ",
-	    ap->rrep6_draft_01.rrep_ps & RREP_PREFIX_MASK,
-	    ap->rrep6_draft_01.rrep_hops,
-	    ip6addr_string(ndo, &ap->rrep6_draft_01.rrep_da),
-	    (unsigned long)EXTRACT_32BITS(&ap->rrep6_draft_01.rrep_ds),
-	    ip6addr_string(ndo, &ap->rrep6_draft_01.rrep_oa),
-	    (unsigned long)EXTRACT_32BITS(&ap->rrep6_draft_01.rrep_life)));
+	    ap->rrep_type & RREP_REPAIR ? "[R]" : "",
+	    ap->rrep_type & RREP_ACK ? "[A] " : " ",
+	    ap->rrep_ps & RREP_PREFIX_MASK,
+	    ap->rrep_hops,
+	    ip6addr_string(ndo, &ap->rrep_da),
+	    (unsigned long)EXTRACT_32BITS(&ap->rrep_ds),
+	    ip6addr_string(ndo, &ap->rrep_oa),
+	    (unsigned long)EXTRACT_32BITS(&ap->rrep_life)));
+	i = length - sizeof(*ap);
 	if (i >= sizeof(struct aodv_ext))
-		aodv_extension(ndo, (void *)(&ap->rrep6_draft_01 + 1), i);
+		aodv_extension(ndo, (const struct aodv_ext *)(dat + sizeof(*ap)), i);
+	return;
+
+trunc:
+	ND_PRINT((ndo, " [|rreq"));
 #else
 	ND_PRINT((ndo, " rrep %u", length));
 #endif
@@ -524,31 +482,37 @@ aodv_v6_draft_01_rrep(netdissect_options *ndo,
 
 static void
 #ifdef INET6
-aodv_v6_draft_01_rerr(netdissect_options *ndo,
-                      const union aodv *ap, u_int length)
+aodv_v6_draft_01_rerr(netdissect_options *ndo, const u_char *dat, u_int length)
 #else
-aodv_v6_draft_01_rerr(netdissect_options *ndo,
-                      const union aodv *ap _U_, u_int length)
+aodv_v6_draft_01_rerr(netdissect_options *ndo, const u_char *dat _U_, u_int length)
 #endif
 {
 #ifdef INET6
-	const struct rerr_unreach6_draft_01 *dp6 = NULL;
-	int i, j, n, trunc;
+	u_int i, dc;
+	const struct aodv_rerr *ap = (const struct aodv_rerr *)dat;
+	const struct rerr_unreach6_draft_01 *dp6;
 
-	i = length - offsetof(struct aodv_rerr, r);
-	j = sizeof(ap->rerr.r.dest6_draft_01[0]);
-	dp6 = &ap->rerr.r.dest6_draft_01[0];
-	n = ap->rerr.rerr_dc * j;
+	ND_TCHECK(*ap);
+	if (length < sizeof(*ap))
+		goto trunc;
 	ND_PRINT((ndo, " rerr %s [items %u] [%u]:",
-	    ap->rerr.rerr_flags & RERR_NODELETE ? "[D]" : "",
-	    ap->rerr.rerr_dc, length));
-	trunc = n - (i/j);
-	for (; i -= j >= 0; ++dp6) {
+	    ap->rerr_flags & RERR_NODELETE ? "[D]" : "",
+	    ap->rerr_dc, length));
+	dp6 = (struct rerr_unreach6_draft_01 *)(void *)(ap + 1);
+	i = length - sizeof(*ap);
+	for (dc = ap->rerr_dc; dc != 0; dc--) {
+		ND_TCHECK(*dp6);
+		if (i < sizeof(*dp6))
+			goto trunc;
 		ND_PRINT((ndo, " {%s}(%ld)", ip6addr_string(ndo, &dp6->u_da),
 		    (unsigned long)EXTRACT_32BITS(&dp6->u_ds)));
+		dp6++;
+		i -= sizeof(*dp6);
 	}
-	if (trunc)
-		ND_PRINT((ndo, "[|rerr]"));
+	return;
+
+trunc:
+	ND_PRINT((ndo, "[|rerr]"));
 #else
 	ND_PRINT((ndo, " rerr %u", length));
 #endif
@@ -558,40 +522,37 @@ void
 aodv_print(netdissect_options *ndo,
            const u_char *dat, u_int length, int is_ip6)
 {
-	const union aodv *ap;
-
-	ap = (union aodv *)dat;
-	if (ndo->ndo_snapend < dat) {
-		ND_PRINT((ndo, " [|aodv]"));
-		return;
-	}
-	if (min(length, (u_int)(ndo->ndo_snapend - dat)) < sizeof(ap->rrep_ack)) {
-		ND_PRINT((ndo, " [|aodv]"));
-		return;
-	}
+	uint8_t msg_type;
+
+	/*
+	 * The message type is the first byte; make sure we have it
+	 * and then fetch it.
+	 */
+	ND_TCHECK(*dat);
+	msg_type = *dat;
 	ND_PRINT((ndo, " aodv"));
 
-	switch (ap->rerr.rerr_type) {
+	switch (msg_type) {
 
 	case AODV_RREQ:
 		if (is_ip6)
-			aodv_v6_rreq(ndo, ap, dat, length);
+			aodv_v6_rreq(ndo, dat, length);
 		else
-			aodv_rreq(ndo, ap, dat, length);
+			aodv_rreq(ndo, dat, length);
 		break;
 
 	case AODV_RREP:
 		if (is_ip6)
-			aodv_v6_rrep(ndo, ap, dat, length);
+			aodv_v6_rrep(ndo, dat, length);
 		else
-			aodv_rrep(ndo, ap, dat, length);
+			aodv_rrep(ndo, dat, length);
 		break;
 
 	case AODV_RERR:
 		if (is_ip6)
-			aodv_v6_rerr(ndo, ap, length);
+			aodv_v6_rerr(ndo, dat, length);
 		else
-			aodv_rerr(ndo, ap, dat, length);
+			aodv_rerr(ndo, dat, length);
 		break;
 
 	case AODV_RREP_ACK:
@@ -599,15 +560,15 @@ aodv_print(netdissect_options *ndo,
 		break;
 
 	case AODV_V6_DRAFT_01_RREQ:
-		aodv_v6_draft_01_rreq(ndo, ap, dat, length);
+		aodv_v6_draft_01_rreq(ndo, dat, length);
 		break;
 
 	case AODV_V6_DRAFT_01_RREP:
-		aodv_v6_draft_01_rrep(ndo, ap, dat, length);
+		aodv_v6_draft_01_rrep(ndo, dat, length);
 		break;
 
 	case AODV_V6_DRAFT_01_RERR:
-		aodv_v6_draft_01_rerr(ndo, ap, length);
+		aodv_v6_draft_01_rerr(ndo, dat, length);
 		break;
 
 	case AODV_V6_DRAFT_01_RREP_ACK:
@@ -615,6 +576,10 @@ aodv_print(netdissect_options *ndo,
 		break;
 
 	default:
-		ND_PRINT((ndo, " %u %u", ap->rreq.rreq_type, length));
+		ND_PRINT((ndo, " type %u %u", msg_type, length));
 	}
+	return;
+
+trunc:
+	ND_PRINT((ndo, " [|aodv]"));
 }