diff options
| author | fenner <fenner@FreeBSD.org> | 2004-01-13 17:28:06 +0000 |
|---|---|---|
| committer | fenner <fenner@FreeBSD.org> | 2004-01-13 17:28:06 +0000 |
| commit | 2160335c024ae1b86bcd6e67fc7a0a103ea3b0f3 (patch) | |
| tree | 4765a3e9a464f6af162f055af022f7e74b00341d /contrib/tcpdump | |
| parent | 4ee5825930265a87ac74b1fe816a194271e67041 (diff) | |
| parent | 31272f2dd4aee1d14f5dfdff511a037d1a070ba8 (diff) | |
| download | FreeBSD-src-2160335c024ae1b86bcd6e67fc7a0a103ea3b0f3.zip FreeBSD-src-2160335c024ae1b86bcd6e67fc7a0a103ea3b0f3.tar.gz | |
This commit was generated by cvs2svn to compensate for changes in r124486,
which included commits to RCS files with non-trunk default branches.
Diffstat (limited to 'contrib/tcpdump')
| -rw-r--r-- | contrib/tcpdump/print-l2tp.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/contrib/tcpdump/print-l2tp.c b/contrib/tcpdump/print-l2tp.c index 2e3c090..a765c03 100644 --- a/contrib/tcpdump/print-l2tp.c +++ b/contrib/tcpdump/print-l2tp.c @@ -476,8 +476,17 @@ l2tp_avp_print(const u_char *dat, int length) TCHECK(*ptr); /* Flags & Length */ len = EXTRACT_16BITS(ptr) & L2TP_AVP_HDR_LEN_MASK; - /* If it is not long enough to decode the entire AVP, we'll - abandon. */ + /* If it is not long enough to contain the header, we'll give up. */ + if (len < 6) + goto trunc; + + /* If it goes past the end of the remaining length of the packet, + we'll give up. */ + if (len > (u_int)length) + goto trunc; + + /* If it goes past the end of the remaining length of the captured + data, we'll give up. */ TCHECK2(*ptr, len); /* After this point, no need to worry about truncation */ |
