diff options
| author | Francois-Xavier Le Bail <devel.fx.lebail@orange.fr> | 2021-02-14 11:35:40 +0100 |
|---|---|---|
| committer | Francois-Xavier Le Bail <devel.fx.lebail@orange.fr> | 2021-02-14 11:40:25 +0100 |
| commit | 5d000b07738ee13d347d721d2492f739b212fdf5 (patch) | |
| tree | 649793714f0fa76ecb8d7a983d9b806cd1f4fec1 /print-l2tp.c | |
| parent | 57577610721997e4721c0d02b7860ef31cc399ba (diff) | |
| download | tcpdump-5d000b07738ee13d347d721d2492f739b212fdf5.tar.gz | |
L2TP: Add a bounds check
Check if the offset padding octets are in the packet buffer.
Diffstat (limited to 'print-l2tp.c')
| -rw-r--r-- | print-l2tp.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/print-l2tp.c b/print-l2tp.c index 184ff752..024705f8 100644 --- a/print-l2tp.c +++ b/print-l2tp.c @@ -807,6 +807,8 @@ l2tp_print(netdissect_options *ndo, const u_char *dat, u_int length) if (flag_o) { /* Offset Size */ pad = GET_BE_U_2(ptr); + /* Offset padding octets in packet buffer? */ + ND_TCHECK_LEN(ptr + 2, pad); ptr += (2 + pad); cnt += (2 + pad); } |