SFLOW: Fix bounds checkingtcpdump-4.4

1 files changed, 52 insertions, 3 deletions

diff --git a/print-sflow.c b/print-sflow.c
index 1a23d49e..d3496cfe 100644
--- a/print-sflow.c
+++ b/print-sflow.c
@@ -311,8 +311,8 @@ print_sflow_counter_generic(const u_char *pointer, u_int len) {
     if (len < sizeof(struct sflow_generic_counter_t))
 	return 1;
 
-
     sflow_gen_counter = (const struct sflow_generic_counter_t *)pointer;
+    TCHECK(*sflow_gen_counter);
     printf("\n\t      ifindex %u, iftype %u, ifspeed %" PRIu64 ", ifdirection %u (%s)",
 	   EXTRACT_32BITS(sflow_gen_counter->ifindex),
 	   EXTRACT_32BITS(sflow_gen_counter->iftype),
@@ -346,6 +346,9 @@ print_sflow_counter_generic(const u_char *pointer, u_int len) {
 	   EXTRACT_32BITS(sflow_gen_counter->ifpromiscmode));
 
     return 0;
+
+trunc:
+    return 1;
 }
 
 static int
@@ -357,6 +360,7 @@ print_sflow_counter_ethernet(const u_char *pointer, u_int len){
 	return 1;
 
     sflow_eth_counter = (const struct sflow_ethernet_counter_t *)pointer;
+    TCHECK(*sflow_eth_counter);
     printf("\n\t      align errors %u, fcs errors %u, single collision %u, multiple collision %u, test error %u",
 	   EXTRACT_32BITS(sflow_eth_counter->alignerrors),
 	   EXTRACT_32BITS(sflow_eth_counter->fcserrors),
@@ -375,6 +379,9 @@ print_sflow_counter_ethernet(const u_char *pointer, u_int len){
 	   EXTRACT_32BITS(sflow_eth_counter->symbol_errors));
 
     return 0;
+
+trunc:
+    return 1;
 }
 
 static int
@@ -392,6 +399,7 @@ print_sflow_counter_basevg(const u_char *pointer, u_int len) {
 	return 1;
 
     sflow_100basevg_counter = (const struct sflow_100basevg_counter_t *)pointer;
+    TCHECK(*sflow_100basevg_counter);
     printf("\n\t      in high prio frames %u, in high prio octets %" PRIu64,
 	   EXTRACT_32BITS(sflow_100basevg_counter->in_highpriority_frames),
 	   EXTRACT_64BITS(sflow_100basevg_counter->in_highpriority_octets));
@@ -416,6 +424,9 @@ print_sflow_counter_basevg(const u_char *pointer, u_int len) {
 	   EXTRACT_64BITS(sflow_100basevg_counter->hc_out_highpriority_octets));
 
     return 0;
+
+trunc:
+    return 1;
 }
 
 static int
@@ -427,6 +438,7 @@ print_sflow_counter_vlan(const u_char *pointer, u_int len) {
 	return 1;
 
     sflow_vlan_counter = (const struct sflow_vlan_counter_t *)pointer;
+    TCHECK(*sflow_vlan_counter);
     printf("\n\t      vlan_id %u, octets %" PRIu64
 	   ", unicast_pkt %u, multicast_pkt %u, broadcast_pkt %u, discards %u",
 	   EXTRACT_32BITS(sflow_vlan_counter->vlan_id),
@@ -437,6 +449,9 @@ print_sflow_counter_vlan(const u_char *pointer, u_int len) {
 	   EXTRACT_32BITS(sflow_vlan_counter->discards));
 
     return 0;
+
+trunc:
+    return 1;
 }
 
 struct sflow_processor_counter_t {
@@ -456,6 +471,7 @@ print_sflow_counter_processor(const u_char *pointer, u_int len) {
 	return 1;
 
     sflow_processor_counter = (const struct sflow_processor_counter_t *)pointer;
+    TCHECK(*sflow_processor_counter);
     printf("\n\t      5sec %u, 1min %u, 5min %u, total_mem %" PRIu64
 	   ", total_mem %" PRIu64,
 	   EXTRACT_32BITS(sflow_processor_counter->five_sec_util),
@@ -465,6 +481,9 @@ print_sflow_counter_processor(const u_char *pointer, u_int len) {
 	   EXTRACT_64BITS(sflow_processor_counter->free_memory));
 
     return 0;
+
+trunc:
+    return 1;
 }
 
 static int
@@ -487,6 +506,7 @@ sflow_print_counter_records(const u_char *pointer, u_int len, u_int records) {
 	if (tlen < sizeof(struct sflow_counter_record_t))
 	    return 1;
 	sflow_counter_record = (const struct sflow_counter_record_t *)tptr;
+	TCHECK(*sflow_counter_record);
 
 	enterprise = EXTRACT_32BITS(sflow_counter_record->format);
 	counter_type = enterprise & 0x0FFF;
@@ -542,6 +562,9 @@ sflow_print_counter_records(const u_char *pointer, u_int len, u_int records) {
     }
 
     return 0;
+
+trunc:
+    return 1;
 }
 
 
@@ -554,11 +577,11 @@ sflow_print_counter_sample(const u_char *pointer, u_int len) {
     u_int           type;
     u_int           index;
 
-
     if (len < sizeof(struct sflow_counter_sample_t))
 	return 1;
 
     sflow_counter_sample = (const struct sflow_counter_sample_t *)pointer;
+    TCHECK(*sflow_counter_sample);
 
     typesource = EXTRACT_32BITS(sflow_counter_sample->typesource);
     nrecords   = EXTRACT_32BITS(sflow_counter_sample->records);
@@ -575,6 +598,8 @@ sflow_print_counter_sample(const u_char *pointer, u_int len) {
 				       len - sizeof(struct sflow_counter_sample_t),
 				       nrecords);
 
+trunc:
+    return 1;
 }
 
 static int
@@ -588,6 +613,7 @@ sflow_print_expanded_counter_sample(const u_char *pointer, u_int len) {
 	return 1;
 
     sflow_expanded_counter_sample = (const struct sflow_expanded_counter_sample_t *)pointer;
+    TCHECK(*sflow_expanded_counter_sample);
 
     nrecords = EXTRACT_32BITS(sflow_expanded_counter_sample->records);
 
@@ -601,6 +627,8 @@ sflow_print_expanded_counter_sample(const u_char *pointer, u_int len) {
 				       len - sizeof(struct sflow_expanded_counter_sample_t),
 				       nrecords);
 
+trunc:
+    return 1;
 }
 
 static int
@@ -612,6 +640,7 @@ print_sflow_raw_packet(const u_char *pointer, u_int len) {
 	return 1;
 
     sflow_flow_raw = (const struct sflow_expanded_flow_raw_t *)pointer;
+    TCHECK(*sflow_flow_raw);
     printf("\n\t      protocol %s (%u), length %u, stripped bytes %u, header_size %u",
 	   tok2str(sflow_flow_raw_protocol_values,"Unknown",EXTRACT_32BITS(sflow_flow_raw->protocol)),
 	   EXTRACT_32BITS(sflow_flow_raw->protocol),
@@ -623,6 +652,9 @@ print_sflow_raw_packet(const u_char *pointer, u_int len) {
        assuming of course there is wnough data present to do so... */
 
     return 0;
+
+trunc:
+    return 1;
 }
 
 static int
@@ -634,12 +666,16 @@ print_sflow_ethernet_frame(const u_char *pointer, u_int len) {
 	return 1;
 
     sflow_ethernet_frame = (const struct sflow_ethernet_frame_t *)pointer;
+    TCHECK(*sflow_ethernet_frame);
 
     printf("\n\t      frame len %u, type %u",
 	   EXTRACT_32BITS(sflow_ethernet_frame->length),
 	   EXTRACT_32BITS(sflow_ethernet_frame->type));
 
     return 0;
+
+trunc:
+    return 1;
 }
 
 static int
@@ -651,6 +687,7 @@ print_sflow_extended_switch_data(const u_char *pointer, u_int len) {
 	return 1;
 
     sflow_extended_sw_data = (const struct sflow_extended_switch_data_t *)pointer;
+    TCHECK(*sflow_extended_sw_data);
     printf("\n\t      src vlan %u, src pri %u, dst vlan %u, dst pri %u",
 	   EXTRACT_32BITS(sflow_extended_sw_data->src_vlan),
 	   EXTRACT_32BITS(sflow_extended_sw_data->src_pri),
@@ -658,6 +695,9 @@ print_sflow_extended_switch_data(const u_char *pointer, u_int len) {
 	   EXTRACT_32BITS(sflow_extended_sw_data->dst_pri));
 
     return 0;
+
+trunc:
+    return 1;
 }
 
 static int
@@ -681,6 +721,7 @@ sflow_print_flow_records(const u_char *pointer, u_int len, u_int records) {
 	    return 1;
 
 	sflow_flow_record = (const struct sflow_flow_record_t *)tptr;
+	TCHECK(*sflow_flow_record);
 
 	/* so, the funky encoding means we cannot blythly mask-off
 	   bits, we must also check the enterprise. */
@@ -743,6 +784,9 @@ sflow_print_flow_records(const u_char *pointer, u_int len, u_int records) {
     }
 
     return 0;
+
+trunc:
+    return 1;
 }
 
 static int
@@ -758,6 +802,7 @@ sflow_print_flow_sample(const u_char *pointer, u_int len) {
 	return 1;
 
     sflow_flow_sample = (struct sflow_flow_sample_t *)pointer;
+    TCHECK(*sflow_flow_sample);
 
     typesource = EXTRACT_32BITS(sflow_flow_sample->typesource);
     nrecords = EXTRACT_32BITS(sflow_flow_sample->records);
@@ -779,6 +824,8 @@ sflow_print_flow_sample(const u_char *pointer, u_int len) {
 				    len - sizeof(struct sflow_flow_sample_t),
 				    nrecords);
 
+trunc:
+    return 1;
 }
 
 static int
@@ -791,6 +838,7 @@ sflow_print_expanded_flow_sample(const u_char *pointer, u_int len) {
 	return 1;
 
     sflow_expanded_flow_sample = (const struct sflow_expanded_flow_sample_t *)pointer;
+    TCHECK(*sflow_expanded_flow_sample);
 
     nrecords = EXTRACT_32BITS(sflow_expanded_flow_sample->records);
 
@@ -807,6 +855,8 @@ sflow_print_expanded_flow_sample(const u_char *pointer, u_int len) {
 				    len - sizeof(struct sflow_expanded_flow_sample_t),
 				    nrecords);
 
+trunc:
+    return 1;
 }
 
 void
@@ -820,7 +870,6 @@ sflow_print(const u_char *pptr, u_int len) {
     u_int32_t sflow_sample_type, sflow_sample_len;
     u_int32_t nsamples;
 
-
     tptr = pptr;
     tlen = len;
     sflow_datagram = (const struct sflow_datagram_t *)pptr;