Import of tcpdump v3.9.8

1 files changed, 35 insertions, 17 deletions

diff --git a/contrib/tcpdump/print-isoclns.c b/contrib/tcpdump/print-isoclns.c
index ca2481f..d3935fc 100644
--- a/contrib/tcpdump/print-isoclns.c
+++ b/contrib/tcpdump/print-isoclns.c
@@ -26,7 +26,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/tcpdump/print-isoclns.c,v 1.133.2.19 2005/09/20 10:15:22 hannes Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/tcpdump/print-isoclns.c,v 1.133.2.25 2007/03/02 09:20:27 hannes Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -475,7 +475,7 @@ static struct tok isis_lsp_istype_values[] = {
     { ISIS_LSP_TYPE_UNUSED0,	"Unused 0x0 (invalid)"},
     { ISIS_LSP_TYPE_LEVEL_1,	"L1 IS"},
     { ISIS_LSP_TYPE_UNUSED2,	"Unused 0x2 (invalid)"},
-    { ISIS_LSP_TYPE_LEVEL_2,	"L1L2 IS"},
+    { ISIS_LSP_TYPE_LEVEL_2,	"L2 IS"},
     { 0, NULL }
 };
 
@@ -1616,7 +1616,11 @@ static int
 isis_print_extd_ip_reach (const u_int8_t *tptr, const char *ident, u_int16_t afi) {
 
     char ident_buffer[20];
+#ifdef INET6
     u_int8_t prefix[sizeof(struct in6_addr)]; /* shared copy buffer for IPv4 and IPv6 prefixes */
+#else
+    u_int8_t prefix[sizeof(struct in_addr)]; /* shared copy buffer for IPv4 prefixes */
+#endif
     u_int metric, status_byte, bit_length, byte_length, sublen, processed, subtlvtype, subtlvlen;
 
     if (!TTEST2(*tptr, 4))
@@ -1630,6 +1634,12 @@ isis_print_extd_ip_reach (const u_int8_t *tptr, const char *ident, u_int16_t afi
             return (0);
         status_byte=*(tptr++);
         bit_length = status_byte&0x3f;
+        if (bit_length > 32) {
+            printf("%sIPv4 prefix: bad bit length %u",
+                   ident,
+                   bit_length);
+            return (0);
+        }
         processed++;
 #ifdef INET6
     } else if (afi == IPV6) {
@@ -1637,6 +1647,12 @@ isis_print_extd_ip_reach (const u_int8_t *tptr, const char *ident, u_int16_t afi
             return (0);
         status_byte=*(tptr++);
         bit_length=*(tptr++);
+        if (bit_length > 128) {
+            printf("%sIPv6 prefix: bad bit length %u",
+                   ident,
+                   bit_length);
+            return (0);
+        }
         processed+=2;
 #endif
     } else
@@ -1646,7 +1662,7 @@ isis_print_extd_ip_reach (const u_int8_t *tptr, const char *ident, u_int16_t afi
    
     if (!TTEST2(*tptr, byte_length))
         return (0);
-    memset(prefix, 0, sizeof(struct in6_addr));              /* clear the copy buffer */
+    memset(prefix, 0, sizeof prefix);   /* clear the copy buffer */
     memcpy(prefix,tptr,byte_length);    /* copy as much as is stored in the TLV */
     tptr+=byte_length;
     processed+=byte_length;
@@ -2092,7 +2108,7 @@ static int isis_print (const u_int8_t *p, u_int length)
                tlv_len);
 
         if (tlv_len == 0) /* something is malformed */
-            break;
+	    continue;
 
         /* now check if we have a decoder otherwise do a hexdump at the end*/
 	switch (tlv_type) {
@@ -2231,13 +2247,14 @@ static int isis_print (const u_int8_t *p, u_int length)
 	    break;
 
         case ISIS_TLV_MT_IP_REACH:
-	    while (tmp>0) {
-                mt_len = isis_print_mtid(tptr, "\n\t      ");
-                if (mt_len == 0) /* did something go wrong ? */
-                    goto trunctlv;
-                tptr+=mt_len;
-                tmp-=mt_len;
+            mt_len = isis_print_mtid(tptr, "\n\t      ");
+            if (mt_len == 0) { /* did something go wrong ? */
+                goto trunctlv;
+            }
+            tptr+=mt_len;
+            tmp-=mt_len;
 
+            while (tmp>0) {
                 ext_ip_len = isis_print_extd_ip_reach(tptr, "\n\t      ", IPV4);
                 if (ext_ip_len == 0) /* did something go wrong ? */
                     goto trunctlv;
@@ -2258,13 +2275,14 @@ static int isis_print (const u_int8_t *p, u_int length)
 	    break;
 
 	case ISIS_TLV_MT_IP6_REACH:
-	    while (tmp>0) {
-                mt_len = isis_print_mtid(tptr, "\n\t      ");
-                if (mt_len == 0) /* did something go wrong ? */
-                    goto trunctlv;
-                tptr+=mt_len;
-                tmp-=mt_len;
+            mt_len = isis_print_mtid(tptr, "\n\t      ");
+            if (mt_len == 0) { /* did something go wrong ? */
+                goto trunctlv;
+            }
+            tptr+=mt_len;
+            tmp-=mt_len;
 
+	    while (tmp>0) {
                 ext_ip_len = isis_print_extd_ip_reach(tptr, "\n\t      ", IPV6);
                 if (ext_ip_len == 0) /* did something go wrong ? */
                     goto trunctlv;
@@ -2514,7 +2532,7 @@ static int isis_print (const u_int8_t *p, u_int length)
             if (!TTEST2(*tptr, ISIS_TLV_RESTART_SIGNALING_HOLDTIMELEN))
                 goto trunctlv;
 
-            printf(", Remaining holding time %us", EXTRACT_16BITS(tptr+1));
+            printf(", Remaining holding time %us", EXTRACT_16BITS(tptr));
             tptr+=ISIS_TLV_RESTART_SIGNALING_HOLDTIMELEN;
             tmp-=ISIS_TLV_RESTART_SIGNALING_HOLDTIMELEN;