Attachment #58223 for bug #90541

View | Details | Raw Unified | Return to bug 90541
Collapse All | Expand All

Lines 1216-1221 Link Here

(-)tcpdump-3.8.3.orig/print-bgp.c (+2 lines)
1216	tptr = pptr + len;	1216	tptr = pptr + len;
1217	break;	1217	break;
1218	}	1218	}
		1219	if (advance < 0) /* infinite loop protection */
		1220	break;
1219	tptr += advance;	1221	tptr += advance;
1220	}	1222	}
1221	break;	1223	break;

Lines 1250-1260 Link Here

(-)tcpdump-3.8.3.orig/print-isoclns.c (-3 / +6 lines)
1250	break;	1250	break;
1251	case L1_CSNP:	1251	case L1_CSNP:
1252	case L2_CSNP:	1252	case L2_CSNP:
1253	printf(", src-id %s", isis_print_id(header_csnp->source_id,SYSTEM_ID_LEN));	1253	printf(", src-id %s", isis_print_id(header_csnp->source_id,NODE_ID_LEN));
1254	break;	1254	break;
1255	case L1_PSNP:	1255	case L1_PSNP:
1256	case L2_PSNP:	1256	case L2_PSNP:
1257	printf(", src-id %s", isis_print_id(header_psnp->source_id,SYSTEM_ID_LEN));	1257	printf(", src-id %s", isis_print_id(header_psnp->source_id,NODE_ID_LEN));
1258	break;	1258	break;
1259		1259
1260	}	1260	}
Lines 1506-1511 Link Here
1506	tlv_type,	1506	tlv_type,
1507	tlv_len);	1507	tlv_len);
1508		1508
		1509	if (tlv_len == 0) /* something is malformed */
		1510	break;
		1511
1509	/* now check if we have a decoder otherwise do a hexdump at the end*/	1512	/* now check if we have a decoder otherwise do a hexdump at the end*/
1510	switch (tlv_type) {	1513	switch (tlv_type) {
1511	case TLV_AREA_ADDR:	1514	case TLV_AREA_ADDR:
Lines 1536-1542 Link Here
1536	break;	1539	break;
1537		1540
1538	case TLV_ISNEIGH_VARLEN:	1541	case TLV_ISNEIGH_VARLEN:
1539	if (!TTEST2(*tptr, 1))	1542	if (!TTEST2(tptr, 1) \|\| tmp < 3) / min. TLV length */
1540	goto trunctlv;	1543	goto trunctlv;
1541	lan_alen = tptr++; / LAN adress length */	1544	lan_alen = tptr++; / LAN adress length */
1542	tmp --;	1545	tmp --;

Lines 326-331 Link Here

(-)tcpdump-3.8.3.orig/print-ldp.c (+3 lines)
326	EXTRACT_32BITS(&ldp_msg_header->id),	326	EXTRACT_32BITS(&ldp_msg_header->id),
327	LDP_MASK_U_BIT(EXTRACT_16BITS(&ldp_msg_header->type)) ? "continue processing" : "ignore");	327	LDP_MASK_U_BIT(EXTRACT_16BITS(&ldp_msg_header->type)) ? "continue processing" : "ignore");
328		328
		329	if (msg_len == 0) /* infinite loop protection */
		330	break;
		331
329	msg_tptr=tptr+sizeof(struct ldp_msg_header);	332	msg_tptr=tptr+sizeof(struct ldp_msg_header);
330	msg_tlen=msg_len-sizeof(struct ldp_msg_header)+4; /* Type & Length fields not included */	333	msg_tlen=msg_len-sizeof(struct ldp_msg_header)+4; /* Type & Length fields not included */
331		334




            switch(rsvp_obj_ctype) {
            case RSVP_CTYPE_IPV4:
                while(obj_tlen >= 4 ) {
                    printf("\n\t    Subobject Type: %s, length %u",
                           tok2str(rsvp_obj_xro_values,
                                   "Unknown %u",
                                   RSVP_OBJ_XRO_MASK_SUBOBJ(*obj_tptr)),
                           *(obj_tptr+1));                

                    if (*(obj_tptr+1) == 0) { /* prevent infinite loops */
                        printf("\n\t      ERROR: zero length ERO subtype");
                        break;
                    }

                    switch(RSVP_OBJ_XRO_MASK_SUBOBJ(*obj_tptr)) {
                    case RSVP_OBJ_XRO_IPV4:
                        printf(", %s, %s/%u, Flags: [%s]",

                if (obj_tlen < 8)
                    return;
                printf("\n\t    Restart  Time: %ums, Recovery Time: %ums",
                       EXTRACT_32BITS(obj_tptr),
                       EXTRACT_32BITS(obj_tptr+4));
                obj_tlen-=8;
                obj_tptr+=8;
                break;

Return to bug 90541

Lines 875-884 Link Here

(-)tcpdump-3.8.3.orig/print-rsvp.c (-4 / +11 lines)
875	switch(rsvp_obj_ctype) {	875	switch(rsvp_obj_ctype) {
876	case RSVP_CTYPE_IPV4:	876	case RSVP_CTYPE_IPV4:
877	while(obj_tlen >= 4 ) {	877	while(obj_tlen >= 4 ) {
878	printf("\n\t Subobject Type: %s",	878	printf("\n\t Subobject Type: %s, length %u",
879	tok2str(rsvp_obj_xro_values,	879	tok2str(rsvp_obj_xro_values,
880	"Unknown %u",	880	"Unknown %u",
881	RSVP_OBJ_XRO_MASK_SUBOBJ(*obj_tptr)));	881	RSVP_OBJ_XRO_MASK_SUBOBJ(*obj_tptr)),
		882	*(obj_tptr+1));
		883
		884	if ((obj_tptr+1) == 0) { / prevent infinite loops */
		885	printf("\n\t ERROR: zero length ERO subtype");
		886	break;
		887	}
		888
882	switch(RSVP_OBJ_XRO_MASK_SUBOBJ(*obj_tptr)) {	889	switch(RSVP_OBJ_XRO_MASK_SUBOBJ(*obj_tptr)) {
883	case RSVP_OBJ_XRO_IPV4:	890	case RSVP_OBJ_XRO_IPV4:
884	printf(", %s, %s/%u, Flags: [%s]",	891	printf(", %s, %s/%u, Flags: [%s]",
Lines 921-928 Link Here
921	if (obj_tlen < 8)	928	if (obj_tlen < 8)
922	return;	929	return;
923	printf("\n\t Restart Time: %ums, Recovery Time: %ums",	930	printf("\n\t Restart Time: %ums, Recovery Time: %ums",
924	EXTRACT_16BITS(obj_tptr),	931	EXTRACT_32BITS(obj_tptr),
925	EXTRACT_16BITS(obj_tptr+4));	932	EXTRACT_32BITS(obj_tptr+4));
926	obj_tlen-=8;	933	obj_tlen-=8;
927	obj_tptr+=8;	934	obj_tptr+=8;
928	break;	935	break;