@@ -399,6 +399,7 @@ lmp_print_data_link_subobjs(netdissect_options *ndo, const u_char *obj_tptr,
399399 "Unknown" ,
400400 EXTRACT_8BITS (obj_tptr + offset + 3 )),
401401 EXTRACT_8BITS (obj_tptr + offset + 3 )));
402+ ND_TCHECK_32BITS (obj_tptr + offset + 4 );
402403 bw .i = EXTRACT_32BITS (obj_tptr + offset + 4 );
403404 ND_PRINT ((ndo , "\n\t Min Reservable Bandwidth: %.3f Mbps" ,
404405 bw .f * 8 /1000000 ));
@@ -419,6 +420,8 @@ lmp_print_data_link_subobjs(netdissect_options *ndo, const u_char *obj_tptr,
419420 offset += subobj_len ;
420421 }
421422 return (hexdump );
423+ trunc :
424+ return -1 ;
422425}
423426
424427void
@@ -429,7 +432,7 @@ lmp_print(netdissect_options *ndo,
429432 const struct lmp_object_header * lmp_obj_header ;
430433 const u_char * tptr ,* obj_tptr ;
431434 u_int tlen ,lmp_obj_len ,lmp_obj_ctype ,obj_tlen ;
432- int hexdump ;
435+ int hexdump , ret ;
433436 u_int offset ;
434437 u_int link_type ;
435438
@@ -731,7 +734,10 @@ lmp_print(netdissect_options *ndo,
731734 ipaddr_string (ndo , obj_tptr + 8 ),
732735 EXTRACT_32BITS (obj_tptr + 8 )));
733736
734- if (lmp_print_data_link_subobjs (ndo , obj_tptr , obj_tlen - 12 , 12 ))
737+ ret = lmp_print_data_link_subobjs (ndo , obj_tptr , obj_tlen - 12 , 12 );
738+ if (ret == -1 )
739+ goto trunc ;
740+ if (ret == TRUE)
735741 hexdump = TRUE;
736742 break ;
737743
@@ -751,7 +757,10 @@ lmp_print(netdissect_options *ndo,
751757 ip6addr_string (ndo , obj_tptr + 20 ),
752758 EXTRACT_32BITS (obj_tptr + 20 )));
753759
754- if (lmp_print_data_link_subobjs (ndo , obj_tptr , obj_tlen - 36 , 36 ))
760+ ret = lmp_print_data_link_subobjs (ndo , obj_tptr , obj_tlen - 36 , 36 );
761+ if (ret == -1 )
762+ goto trunc ;
763+ if (ret == TRUE)
755764 hexdump = TRUE;
756765 break ;
757766
@@ -771,7 +780,10 @@ lmp_print(netdissect_options *ndo,
771780 EXTRACT_32BITS (obj_tptr + 8 ),
772781 EXTRACT_32BITS (obj_tptr + 8 )));
773782
774- if (lmp_print_data_link_subobjs (ndo , obj_tptr , obj_tlen - 12 , 12 ))
783+ ret = lmp_print_data_link_subobjs (ndo , obj_tptr , obj_tlen - 12 , 12 );
784+ if (ret == -1 )
785+ goto trunc ;
786+ if (ret == TRUE)
775787 hexdump = TRUE;
776788 break ;
777789
0 commit comments