diff options
| -rw-r--r-- | print-ldp.c | 12 | ||||
| -rw-r--r-- | tests/ldp-ldp_tlv_print-oobr.out | 3 |
2 files changed, 9 insertions, 6 deletions
diff --git a/print-ldp.c b/print-ldp.c index 49379f0d..b747fe7d 100644 --- a/print-ldp.c +++ b/print-ldp.c @@ -231,7 +231,11 @@ static u_int ldp_pdu_print(netdissect_options *, const u_char *); */ #define TLV_TCHECK(minlen) \ - ND_TCHECK_LEN(tptr, minlen); if (tlv_tlen < minlen) goto badtlv; + if (tlv_tlen < minlen) { \ + ND_PRINT(" [tlv length %u < %u]", tlv_tlen, minlen); \ + nd_print_invalid(ndo); \ + goto invalid; \ + } static u_int ldp_tlv_print(netdissect_options *ndo, @@ -487,7 +491,7 @@ ldp_tlv_print(netdissect_options *ndo, break; case LDP_TLV_FT_SESSION: - TLV_TCHECK(8); + TLV_TCHECK(12); ft_flags = GET_BE_U_2(tptr); ND_PRINT("\n\t Flags: [%sReconnect, %sSave State, %sAll-Label Protection, %s Checkpoint, %sRe-Learn State]", ft_flags&0x8000 ? "" : "No ", @@ -495,6 +499,7 @@ ldp_tlv_print(netdissect_options *ndo, ft_flags&0x4 ? "" : "No ", ft_flags&0x2 ? "Sequence Numbered Label" : "All Labels", ft_flags&0x1 ? "" : "Don't "); + /* 16 bits (FT Flags) + 16 bits (Reserved) */ tptr+=4; ui = GET_BE_U_4(tptr); if (ui) @@ -538,8 +543,7 @@ trunc: nd_print_trunc(ndo); return 0; -badtlv: - ND_PRINT("\n\t\t TLV contents go past end of TLV"); +invalid: return(tlv_len+4); /* Type & Length fields not included */ } diff --git a/tests/ldp-ldp_tlv_print-oobr.out b/tests/ldp-ldp_tlv_print-oobr.out index d1e64c8e..f16928b1 100644 --- a/tests/ldp-ldp_tlv_print-oobr.out +++ b/tests/ldp-ldp_tlv_print-oobr.out @@ -3,5 +3,4 @@ LDP, Label-Space-ID: 0.0.127.255:796, pdu-length: 514 Address Withdraw Message (0x0301), length: 22, Message ID: 0x00001600, Flags: [ignore if unknown] Unknown TLV (0x0404), length: 0, Flags: [ignore and don't forward if unknown] - Fault-Tolerant Session Parameters TLV (0x0503), length: 8, Flags: [ignore and don't forward if unknown] - Flags: [No Reconnect, Don't Save State, No All-Label Protection, Sequence Numbered Label Checkpoint, Re-Learn State], Reconnect Timeout: 50331648ms [|ldp] + Fault-Tolerant Session Parameters TLV (0x0503), length: 8, Flags: [ignore and don't forward if unknown] [tlv length 8 < 12] (invalid) [|ldp] |