Merge r309649, r313048, r313083, r313104:

  tcpdump 4.9.0

1 files changed, 28 insertions, 8 deletions

diff --git a/contrib/tcpdump/print-egp.c b/contrib/tcpdump/print-egp.c
index 9c5c811..8fba9ce 100644
--- a/contrib/tcpdump/print-egp.c
+++ b/contrib/tcpdump/print-egp.c
@@ -18,14 +18,15 @@
  * Initial contribution from Jeff Honig (jch@MITCHELL.CIT.CORNELL.EDU).
  */
 
-#define NETDISSECT_REWORKED
+/* \summary: Exterior Gateway Protocol (EGP) printer */
+
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
 
-#include <tcpdump-stdinc.h>
+#include <netdissect-stdinc.h>
 
-#include "interface.h"
+#include "netdissect.h"
 #include "addrtoname.h"
 #include "extract.h"
 
@@ -128,7 +129,7 @@ static const char *egp_reasons[] = {
 
 static void
 egpnrprint(netdissect_options *ndo,
-           register const struct egp_packet *egp)
+           register const struct egp_packet *egp, u_int length)
 {
 	register const uint8_t *cp;
 	uint32_t addr;
@@ -152,12 +153,15 @@ egpnrprint(netdissect_options *ndo,
 		net = 0;
 		netlen = 0;
 	}
-	cp = (uint8_t *)(egp + 1);
+	cp = (const uint8_t *)(egp + 1);
+	length -= sizeof(*egp);
 
 	t_gateways = egp->egp_intgw + egp->egp_extgw;
 	for (gateways = 0; gateways < t_gateways; ++gateways) {
 		/* Pickup host part of gateway address */
 		addr = 0;
+		if (length < 4 - netlen)
+			goto trunc;
 		ND_TCHECK2(cp[0], 4 - netlen);
 		switch (netlen) {
 
@@ -171,8 +175,12 @@ egpnrprint(netdissect_options *ndo,
 			addr = (addr << 8) | *cp++;
 		}
 		addr |= net;
+		length -= 4 - netlen;
+		if (length < 1)
+			goto trunc;
 		ND_TCHECK2(cp[0], 1);
 		distances = *cp++;
+		length--;
 		ND_PRINT((ndo, " %s %s ",
 		       gateways < (int)egp->egp_intgw ? "int" : "ext",
 		       ipaddr_string(ndo, &addr)));
@@ -180,21 +188,33 @@ egpnrprint(netdissect_options *ndo,
 		comma = "";
 		ND_PRINT((ndo, "("));
 		while (--distances >= 0) {
+			if (length < 2)
+				goto trunc;
 			ND_TCHECK2(cp[0], 2);
 			ND_PRINT((ndo, "%sd%d:", comma, (int)*cp++));
 			comma = ", ";
 			networks = *cp++;
+			length -= 2;
 			while (--networks >= 0) {
 				/* Pickup network number */
+				if (length < 1)
+					goto trunc;
 				ND_TCHECK2(cp[0], 1);
 				addr = (uint32_t)*cp++ << 24;
+				length--;
 				if (IN_CLASSB(addr)) {
+					if (length < 1)
+						goto trunc;
 					ND_TCHECK2(cp[0], 1);
 					addr |= (uint32_t)*cp++ << 16;
+					length--;
 				} else if (!IN_CLASSA(addr)) {
+					if (length < 2)
+						goto trunc;
 					ND_TCHECK2(cp[0], 2);
 					addr |= (uint32_t)*cp++ << 16;
 					addr |= (uint32_t)*cp++ << 8;
+					length -= 2;
 				}
 				ND_PRINT((ndo, " %s", ipaddr_string(ndo, &addr)));
 			}
@@ -215,8 +235,8 @@ egp_print(netdissect_options *ndo,
 	register int code;
 	register int type;
 
-	egp = (struct egp_packet *)bp;
-        if (!ND_TTEST2(*egp, length)) {
+	egp = (const struct egp_packet *)bp;
+	if (length < sizeof(*egp) || !ND_TTEST(*egp)) {
 		ND_PRINT((ndo, "[|egp]"));
 		return;
 	}
@@ -333,7 +353,7 @@ egp_print(netdissect_options *ndo,
 		       egp->egp_intgw,
 		       egp->egp_extgw));
 		if (ndo->ndo_vflag)
-			egpnrprint(ndo, egp);
+			egpnrprint(ndo, egp, length);
 		break;
 
 	case EGPT_ERROR: