diff options
| author | Gordon Tetlow <gordon@FreeBSD.org> | 2017-09-18 04:10:54 +0000 |
|---|---|---|
| committer | Gordon Tetlow <gordon@FreeBSD.org> | 2017-09-18 04:10:54 +0000 |
| commit | 4533b6d8a9b95fc043b72b3656b98e79ac839041 (patch) | |
| tree | 4ac156eafa4323886af859c09363dff43cc44106 /print-ip6.c | |
| parent | d79b843cb78484ea27f877f1541055e1a6a5a4d3 (diff) | |
Diffstat (limited to 'print-ip6.c')
| -rw-r--r-- | print-ip6.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/print-ip6.c b/print-ip6.c index 9f590f2af4e1..a634d7b83117 100644 --- a/print-ip6.c +++ b/print-ip6.c @@ -280,6 +280,8 @@ ip6_print(netdissect_options *ndo, const u_char *bp, u_int length) advance = sizeof(struct ip6_hdr); nh = ip6->ip6_nxt; while (cp < ndo->ndo_snapend && advance > 0) { + if (len < (u_int)advance) + goto trunc; cp += advance; len -= advance; @@ -322,10 +324,15 @@ ip6_print(netdissect_options *ndo, const u_char *bp, u_int length) * mobility header. */ advance = mobility_print(ndo, cp, (const u_char *)ip6); + if (advance < 0) + return; nh = *cp; return; case IPPROTO_ROUTING: + ND_TCHECK(*cp); advance = rt6_print(ndo, cp, (const u_char *)ip6); + if (advance < 0) + return; nh = *cp; break; case IPPROTO_SCTP: @@ -345,12 +352,16 @@ ip6_print(netdissect_options *ndo, const u_char *bp, u_int length) return; case IPPROTO_AH: advance = ah_print(ndo, cp); + if (advance < 0) + return; nh = *cp; break; case IPPROTO_ESP: { int enh, padlen; advance = esp_print(ndo, cp, len, (const u_char *)ip6, &enh, &padlen); + if (advance < 0) + return; nh = enh & 0xff; len -= padlen; break; |