diff options
| author | Philip Paeps <philip@FreeBSD.org> | 2019-10-06 04:36:53 +0000 |
|---|---|---|
| committer | Philip Paeps <philip@FreeBSD.org> | 2019-10-06 04:36:53 +0000 |
| commit | f91036a44a189fa5d0b5f1c6dea0a396a0f928c0 (patch) | |
| tree | 2cd0554d9f0826a4e0bc63c5e4ca83ece65bee24 /print-babel.c | |
| parent | 810711ec13a9424633df50e0a1af057a68e2ed45 (diff) | |
Notes
Diffstat (limited to 'print-babel.c')
| -rw-r--r-- | print-babel.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/print-babel.c b/print-babel.c index f8741d7bfd19..0bb2483adedb 100644 --- a/print-babel.c +++ b/print-babel.c @@ -352,6 +352,8 @@ babel_print_v2(netdissect_options *ndo, goto invalid; bodylen = EXTRACT_16BITS(cp + 2); ND_PRINT((ndo, " (%u)", bodylen)); + if (4U + bodylen > length) + goto invalid; /* Process the TLVs in the body */ i = 0; @@ -480,7 +482,7 @@ babel_print_v2(netdissect_options *ndo, case MESSAGE_UPDATE: { if (!ndo->ndo_vflag) { ND_PRINT((ndo, " update")); - if(len < 1) + if(len < 10) ND_PRINT((ndo, "/truncated")); else ND_PRINT((ndo, "%s%s%s", |