On 2015/10/11 05:02, Kevin Reay wrote:
> Fix a tcpdump segfault when attempting to print an invalid DECnet
> packet.
>
> DECnet packet printing code could cause a segfault on an impossibly
> large packet from a specifically crafted packet.
>
> The segfault would occur in tcpdump.c:default_print() called by
> print-decnet.c:decnet_print().
>
> Patch built using changes from upstream repo; Git commit:
> f61639179282f8e796966b21e45f79db317d7bdb
> https://github.com/the-tcpdump-group/tcpdump/commit/f61639179282f8e796
> 966b21e45f79db317d7bdb
>
> Changes adapted to older version of tcpdump in tree. Patch adds
> various length/size checks including TCHECK* throughout. Brings
> print-decnet.c length validation in-line with other print-*.c files.
> Additionally adds return values to internal print_* functions to
> indicate failure of new checks.
>
> Does not include the header no-copy optimization that was in the
> upstream patch.
>
> Feedback is greatly appreciated. Let me know if there are any
> questions, or if troublesome pcaps and backtrack are wanted.
>
> Tested with various pcaps. Behavior now matches newer upstream version
> on Linux.
couple of nits:
> @@ -564,7 +678,7 @@ print_nsp(const u_char *nspp, u_int nspl
> case COS_SEGMENT:
> (void)printf("seg ");
> break;
> - case COS_MESSAGE:
> + case COS_MESSAGE:
unnecessary whitespace change (new one is wrong)
> (void)printf("msg ");
> break;
> case COS_CRYPTSER:
> @@ -573,7 +687,7 @@ print_nsp(const u_char *nspp, u_int nspl
> }
> switch (info & COI_MASK) {
> case COI_32:
> - (void)printf("ver 3.2 ");
> + (void)printf("ver 3.2 ");
same
otherwise OK with me.
