diff options
| author | guy <guy> | 2005-05-06 08:26:44 +0000 |
|---|---|---|
| committer | guy <guy> | 2005-05-06 08:26:44 +0000 |
| commit | 638229f1b61a4a7a44e7939fae11079382690242 (patch) | |
| tree | 795fe7404d6933c048359b5c77e410a657d60f2f /print-ipx.c | |
| parent | 6191f36146f5d286304e9b6e893477fe509d83ab (diff) | |
| download | tcpdump-638229f1b61a4a7a44e7939fae11079382690242.tar.gz | |
Bounds-check the individual components of a SAP reply.
Make "fn_printzp()" return 0 if we don't run past the end of the packet
and we don't find any padding NULs.
Diffstat (limited to 'print-ipx.c')
| -rw-r--r-- | print-ipx.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/print-ipx.c b/print-ipx.c index d5803b9d..604561c6 100644 --- a/print-ipx.c +++ b/print-ipx.c @@ -24,7 +24,7 @@ #ifndef lint static const char rcsid[] _U_ = - "@(#) $Header: /tcpdump/master/tcpdump/print-ipx.c,v 1.41 2005-05-06 07:56:52 guy Exp $"; + "@(#) $Header: /tcpdump/master/tcpdump/print-ipx.c,v 1.42 2005-05-06 08:26:44 guy Exp $"; #endif #ifdef HAVE_CONFIG_H @@ -159,12 +159,13 @@ ipx_sap_print(const u_short *ipx, u_int length) (void)printf("ipx-sap-nearest-resp"); for (i = 0; i < 8 && length > 0; i++) { - TCHECK2(ipx[25], 10); + TCHECK(ipx[0]); (void)printf(" %s '", ipxsap_string(htons(EXTRACT_16BITS(&ipx[0])))); if (fn_printzp((u_char *)&ipx[1], 48, snapend)) { printf("'"); goto trunc; } + TCHECK2(ipx[25], 10); printf("' addr %s", ipxaddr_string(EXTRACT_32BITS(&ipx[25]), (u_char *)&ipx[27])); ipx += 32; |