The remaining buffer size for ICMP6_TIME_EXCEEDED is only the buffer length
minus the IPv6 header. It could now be discussed whether the output length
should now be with or without the icmp6_hdr length. The length with
icmp6_hdr was chosen because the code looks like a simple copy and paste
error and ip6_hdr's length was most likely the actual intent for the
calculation.
Fixes: 35b37756f4a3 ("add IPv6 support to tcpdump parser")
Signed-off-by: Sven Eckelmann <[email protected]>
---
tcpdump.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tcpdump.c b/tcpdump.c
index 0895c61..9c90f36 100644
--- a/tcpdump.c
+++ b/tcpdump.c
@@ -669,7 +669,7 @@ static void dump_ipv6(unsigned char *packet_buff, ssize_t
buff_len,
break;
case ICMP6_TIME_EXCEEDED:
printf(" time exceeded in-transit, length %zu\n",
- (size_t)buff_len - sizeof(struct icmp6_hdr));
+ (size_t)buff_len - sizeof(struct ip6_hdr));
break;
case ND_NEIGHBOR_SOLICIT:
LEN_CHECK((size_t)buff_len - (size_t)(sizeof(struct
ip6_hdr)),
--
2.47.3
