diff options
| author | Moritz Jodeit <moritz@cvs.openbsd.org> | 2006-05-28 22:48:17 +0000 |
|---|---|---|
| committer | Moritz Jodeit <moritz@cvs.openbsd.org> | 2006-05-28 22:48:17 +0000 |
| commit | a840a34f9caf3ef417a2d1b3b90443d7ce91f9c9 (patch) | |
| tree | 5f30dd53f9112f3da98fbae9dba3d3e91dcd22a8 | |
| parent | b40f9ab72b387e9999bcc49b0aa2e9c95776f7b0 (diff) | |
Correct more bounds checks which can lead to crashes.
ok canacar@ deraadt@
| -rw-r--r-- | usr.sbin/tcpdump/print-tcp.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/usr.sbin/tcpdump/print-tcp.c b/usr.sbin/tcpdump/print-tcp.c index ded25296976..16e6e61e844 100644 --- a/usr.sbin/tcpdump/print-tcp.c +++ b/usr.sbin/tcpdump/print-tcp.c @@ -1,4 +1,4 @@ -/* $OpenBSD: print-tcp.c,v 1.23 2004/09/16 14:02:07 markus Exp $ */ +/* $OpenBSD: print-tcp.c,v 1.24 2006/05/28 22:48:16 moritz Exp $ */ /* * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 @@ -23,7 +23,7 @@ #ifndef lint static const char rcsid[] = - "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-tcp.c,v 1.23 2004/09/16 14:02:07 markus Exp $ (LBL)"; + "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-tcp.c,v 1.24 2006/05/28 22:48:16 moritz Exp $ (LBL)"; #endif #include <sys/param.h> @@ -596,7 +596,7 @@ tcp_print(register const u_char *bp, register u_int length, (void)printf("tcpmd5:"); datalen = len - 2; for (i = 0; i < datalen; ++i) { - LENCHECK(i); + LENCHECK(i+1); (void)printf("%02x", cp[i]); } break; @@ -605,7 +605,7 @@ tcp_print(register const u_char *bp, register u_int length, (void)printf("opt-%d:", opt); datalen = len - 2; for (i = 0; i < datalen; ++i) { - LENCHECK(i); + LENCHECK(i+1); (void)printf("%02x", cp[i]); } break; @@ -688,7 +688,7 @@ print_tcp_rst_data(register const u_char *sp, u_int length) putchar('+'); /* indicate we truncate */ } putchar(' '); - while (length-- && sp <= snapend) { + while (length-- && sp < snapend) { c = *sp++; safeputchar(c); } |