nhrp: fix infinite loop on malformed packets.

If a CIE doesn't fit in the remainder of the mandatory part, return the
length of that remainder, so that the loop processing the CIE
terminates.

Add capture that produced the infinite loop.

1 files changed, 10 insertions, 0 deletions

diff --git a/print-nhrp.c b/print-nhrp.c
index 800d5c53..6947a7ca 100644
--- a/print-nhrp.c
+++ b/print-nhrp.c
@@ -480,5 +480,15 @@ nhrp_print_cie(netdissect_options *ndo, const u_char *data, uint16_t mand_part_l
 
 invalid:
 	nd_print_invalid(ndo);
+
+	/*
+	 * We get here because this CIE goes past thE remaining length,
+	 * of the mandatory part.  We've reported that error; we now
+	 * assignt he insufficnetly-large remaining piece of the
+	 * mandatory part to this CIE, so that this CIE finishes up
+	 * the mandatory part, and the loop processing the CIEs
+	 * terminates.  There cannot be any CIEs after this one.
+	 */
+	cie_len += mand_part_len;
 	return (cie_len);
 }