aboutsummaryrefslogtreecommitdiffstats
path: root/print-babel.c
diff options
context:
space:
mode:
authorPhilip Paeps <philip@FreeBSD.org>2019-10-06 04:36:53 +0000
committerPhilip Paeps <philip@FreeBSD.org>2019-10-06 04:36:53 +0000
commitf91036a44a189fa5d0b5f1c6dea0a396a0f928c0 (patch)
tree2cd0554d9f0826a4e0bc63c5e4ca83ece65bee24 /print-babel.c
parent810711ec13a9424633df50e0a1af057a68e2ed45 (diff)
downloadsrc-vendor/tcpdump.tar.gz
src-vendor/tcpdump.zip
Vendor import of tcpdump 4.9.3vendor/tcpdump
Notes
Notes: svn path=/vendor/tcpdump/dist/; revision=353144
Diffstat (limited to 'print-babel.c')
-rw-r--r--print-babel.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/print-babel.c b/print-babel.c
index f8741d7bfd19..0bb2483adedb 100644
--- a/print-babel.c
+++ b/print-babel.c
@@ -352,6 +352,8 @@ babel_print_v2(netdissect_options *ndo,
goto invalid;
bodylen = EXTRACT_16BITS(cp + 2);
ND_PRINT((ndo, " (%u)", bodylen));
+ if (4U + bodylen > length)
+ goto invalid;
/* Process the TLVs in the body */
i = 0;
@@ -480,7 +482,7 @@ babel_print_v2(netdissect_options *ndo,
case MESSAGE_UPDATE: {
if (!ndo->ndo_vflag) {
ND_PRINT((ndo, " update"));
- if(len < 1)
+ if(len < 10)
ND_PRINT((ndo, "/truncated"));
else
ND_PRINT((ndo, "%s%s%s",