- ac fix for 3.7.2/Ra

[packages/tcpdump.git] / tcpdump-l2tp-CAN-2003-1029.patch

--- print-l2tp.c
+++ print-l2tp.c
@@ -476,8 +476,18 @@
 	TCHECK(*ptr);	/* Flags & Length */
 	len = EXTRACT_16BITS(ptr) & L2TP_AVP_HDR_LEN_MASK;
 
-	/* If it is not long enough to decode the entire AVP, we'll 
-	   abandon. */
+       /* If it is not long enough to contain the header, we'll give up. */
+       if (len < 6)
+               goto trunc;
+
+       /* If it goes past the end of the remaining length of the packet,
+          we'll give up. */
+       if (len > (u_int)length)
+               goto trunc;
+
+       /* If it goes past the end of the remaining length of the captured
+          data, we'll give up. */
+
 	TCHECK2(*ptr, len);
 	/* After this point, no need to worry about truncation */