1 files changed, 32 insertions, 12 deletions

diff --git a/contrib/libpcap/testprogs/filtertest.c b/contrib/libpcap/testprogs/filtertest.c
index 7e2d6d6e186d..15556d045cf7 100644
--- a/contrib/libpcap/testprogs/filtertest.c
+++ b/contrib/libpcap/testprogs/filtertest.c
@@ -36,6 +36,7 @@ The Regents of the University of California.  All rights reserved.\n";
 #include <stdlib.h>
 #include <string.h>
 #include <stdarg.h>
+#include <limits.h>
 #ifdef _WIN32
   #include "getopt.h"
   #include "unix.h"
@@ -56,6 +57,8 @@ The Regents of the University of California.  All rights reserved.\n";
 
 #include "pcap/funcattrs.h"
 
+#define MAXIMUM_SNAPLEN		262144
+
 #ifdef BDEBUG
 /*
  * We have pcap_set_optimizer_debug() and pcap_set_print_dot_graph() in
@@ -99,11 +102,21 @@ read_infile(char *fname)
 	if (fstat(fd, &buf) < 0)
 		error("can't stat %s: %s", fname, pcap_strerror(errno));
 
+	/*
+	 * _read(), on Windows, has an unsigned int byte count and an
+	 * int return value, so we can't handle a file bigger than
+	 * INT_MAX - 1 bytes (and have no reason to do so; a filter *that*
+	 * big will take forever to compile).  (The -1 is for the '\0' at
+	 * the end of the string.)
+	 */
+	if (buf.st_size > INT_MAX - 1)
+		error("%s is larger than %d bytes; that's too large", fname,
+		    INT_MAX - 1);
 	cp = malloc((u_int)buf.st_size + 1);
 	if (cp == NULL)
 		error("malloc(%d) for %s: %s", (u_int)buf.st_size + 1,
 			fname, pcap_strerror(errno));
-	cc = read(fd, cp, (u_int)buf.st_size);
+	cc = (int)read(fd, cp, (u_int)buf.st_size);
 	if (cc < 0)
 		error("read %s: %s", fname, pcap_strerror(errno));
 	if (cc != buf.st_size)
@@ -163,7 +176,7 @@ static char *
 copy_argv(register char **argv)
 {
 	register char **p;
-	register u_int len = 0;
+	register size_t len = 0;
 	char *buf;
 	char *src, *dst;
 
@@ -196,13 +209,14 @@ main(int argc, char **argv)
 	char *cp;
 	int op;
 	int dflag;
+#ifdef BDEBUG
 	int gflag;
+#endif
 	char *infile;
 	int Oflag;
-	long snaplen;
+	int snaplen;
 	char *p;
 	int dlt;
-	int have_fcode = 0;
 	bpf_u_int32 netmask = PCAP_NETMASK_UNKNOWN;
 	char *cmdbuf;
 	pcap_t *pd;
@@ -214,11 +228,13 @@ main(int argc, char **argv)
 #endif /* _WIN32 */
 
 	dflag = 1;
+#ifdef BDEBUG
 	gflag = 0;
+#endif
 
 	infile = NULL;
 	Oflag = 1;
-	snaplen = 68;
+	snaplen = MAXIMUM_SNAPLEN;
 
 	if ((cp = strrchr(argv[0], '/')) != NULL)
 		program_name = cp + 1;
@@ -272,13 +288,19 @@ main(int argc, char **argv)
 
 		case 's': {
 			char *end;
+			long long_snaplen;
 
-			snaplen = strtol(optarg, &end, 0);
+			long_snaplen = strtol(optarg, &end, 0);
 			if (optarg == end || *end != '\0'
-			    || snaplen < 0 || snaplen > 65535)
+			    || long_snaplen < 0
+			    || long_snaplen > MAXIMUM_SNAPLEN)
 				error("invalid snaplen %s", optarg);
-			else if (snaplen == 0)
-				snaplen = 65535;
+			else {
+				if (snaplen == 0)
+					snaplen = MAXIMUM_SNAPLEN;
+				else
+					snaplen = (int)long_snaplen;
+			}
 			break;
 		}
 
@@ -317,7 +339,6 @@ main(int argc, char **argv)
 	if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
 		error("%s", pcap_geterr(pd));
 
-	have_fcode = 1;
 	if (!bpf_validate(fcode.bf_insns, fcode.bf_len))
 		warn("Filter doesn't pass validation");
 
@@ -337,8 +358,7 @@ main(int argc, char **argv)
 
 	bpf_dump(&fcode, dflag);
 	free(cmdbuf);
-	if (have_fcode)
-		pcap_freecode (&fcode);
+	pcap_freecode (&fcode);
 	pcap_close(pd);
 	exit(0);
 }