@@ -145,32 +145,29 @@ aodv_rrep(const struct aodv_rrep *ap, const u_char *dat, u_int length)
145
145
static void
146
146
aodv_rerr (const struct aodv_rerr * ap , const u_char * dat , u_int length )
147
147
{
148
- u_int i ;
149
- const struct rerr_unreach * dp = NULL ;
150
- int n , trunc ;
148
+ u_int i , dc ;
149
+ const struct rerr_unreach * dp ;
151
150
152
151
if (snapend < dat ) {
153
152
printf (" [|aodv]" );
154
153
return ;
155
154
}
156
155
i = min (length , (u_int )(snapend - dat ));
157
- if (i < offsetof( struct aodv_rerr , r )) {
156
+ if (i < sizeof ( * ap )) {
158
157
printf (" [|rerr]" );
159
158
return ;
160
159
}
161
- i -= offsetof(struct aodv_rerr , r );
162
- dp = & ap -> r .dest [0 ];
163
- n = ap -> rerr_dc * sizeof (ap -> r .dest [0 ]);
160
+ i -= sizeof (* ap );
164
161
printf (" rerr %s [items %u] [%u]:" ,
165
162
ap -> rerr_flags & RERR_NODELETE ? "[D]" : "" ,
166
163
ap -> rerr_dc , length );
167
- trunc = n - ( i / sizeof (ap -> r . dest [ 0 ]) );
168
- for (; i >= sizeof (ap -> r . dest [ 0 ] );
169
- ++ dp , i -= sizeof (ap -> r . dest [ 0 ] )) {
164
+ dp = ( struct rerr_unreach * )( void * ) (ap + 1 );
165
+ for (dc = ap -> rerr_dc ; dc != 0 && i >= sizeof (* dp );
166
+ ++ dp , -- dc , i -= sizeof (* dp )) {
170
167
printf (" {%s}(%ld)" , ipaddr_string (& dp -> u_da ),
171
168
(unsigned long )EXTRACT_32BITS (& dp -> u_ds ));
172
169
}
173
- if (trunc )
170
+ if (( i % sizeof ( * dp )) != 0 )
174
171
printf ("[|rerr]" );
175
172
}
176
173
@@ -253,28 +250,35 @@ aodv_v6_rrep(const struct aodv_rrep6 *ap _U_, const u_char *dat _U_, u_int lengt
253
250
254
251
static void
255
252
#ifdef INET6
256
- aodv_v6_rerr (const struct aodv_rerr * ap , u_int length )
253
+ aodv_v6_rerr (const struct aodv_rerr * ap , const u_char * dat , u_int length )
257
254
#else
258
- aodv_v6_rerr (const struct aodv_rerr * ap _U_ , u_int length )
255
+ aodv_v6_rerr (const struct aodv_rerr * ap _U_ , const u_char * dat , u_int length )
259
256
#endif
260
257
{
261
258
#ifdef INET6
262
- const struct rerr_unreach6 * dp6 = NULL ;
263
- int i , j , n , trunc ;
259
+ u_int i , dc ;
260
+ const struct rerr_unreach6 * dp6 ;
264
261
265
- i = length - offsetof(struct aodv_rerr , r );
266
- j = sizeof (ap -> r .dest6 [0 ]);
267
- dp6 = & ap -> r .dest6 [0 ];
268
- n = ap -> rerr_dc * j ;
262
+ if (snapend < dat ) {
263
+ printf (" [|aodv]" );
264
+ return ;
265
+ }
266
+ i = min (length , (u_int )(snapend - dat ));
267
+ if (i < sizeof (* ap )) {
268
+ printf (" [|rerr]" );
269
+ return ;
270
+ }
271
+ i -= sizeof (* ap );
269
272
printf (" rerr %s [items %u] [%u]:" ,
270
273
ap -> rerr_flags & RERR_NODELETE ? "[D]" : "" ,
271
274
ap -> rerr_dc , length );
272
- trunc = n - (i /j );
273
- for (; i -= j >= 0 ; ++ dp6 ) {
275
+ dp6 = (struct rerr_unreach6 * )(void * )(ap + 1 );
276
+ for (dc = ap -> rerr_dc ; dc != 0 && i >= sizeof (* dp6 );
277
+ ++ dp6 , -- dc , i -= sizeof (* dp6 )) {
274
278
printf (" {%s}(%ld)" , ip6addr_string (& dp6 -> u_da ),
275
279
(unsigned long )EXTRACT_32BITS (& dp6 -> u_ds ));
276
280
}
277
- if (trunc )
281
+ if (( i % sizeof ( * dp6 )) != 0 )
278
282
printf ("[|rerr]" );
279
283
#else
280
284
printf (" rerr %u" , length );
@@ -360,28 +364,35 @@ aodv_v6_draft_01_rrep(const struct aodv_rrep6_draft_01 *ap _U_, const u_char *da
360
364
361
365
static void
362
366
#ifdef INET6
363
- aodv_v6_draft_01_rerr (const struct aodv_rerr * ap , u_int length )
367
+ aodv_v6_draft_01_rerr (const struct aodv_rerr * ap , const u_char * dat , u_int length )
364
368
#else
365
- aodv_v6_draft_01_rerr (const struct aodv_rerr * ap _U_ , u_int length )
369
+ aodv_v6_draft_01_rerr (const struct aodv_rerr * ap _U_ , const u_char * dat , u_int length )
366
370
#endif
367
371
{
368
372
#ifdef INET6
369
- const struct rerr_unreach6_draft_01 * dp6 = NULL ;
370
- int i , j , n , trunc ;
373
+ u_int i , dc ;
374
+ const struct rerr_unreach6_draft_01 * dp6 ;
371
375
372
- i = length - offsetof(struct aodv_rerr , r );
373
- j = sizeof (ap -> r .dest6_draft_01 [0 ]);
374
- dp6 = & ap -> r .dest6_draft_01 [0 ];
375
- n = ap -> rerr_dc * j ;
376
+ if (snapend < dat ) {
377
+ printf (" [|aodv]" );
378
+ return ;
379
+ }
380
+ i = min (length , (u_int )(snapend - dat ));
381
+ if (i < sizeof (* ap )) {
382
+ printf (" [|rerr]" );
383
+ return ;
384
+ }
385
+ i -= sizeof (* ap );
376
386
printf (" rerr %s [items %u] [%u]:" ,
377
387
ap -> rerr_flags & RERR_NODELETE ? "[D]" : "" ,
378
388
ap -> rerr_dc , length );
379
- trunc = n - (i /j );
380
- for (; i -= j >= 0 ; ++ dp6 ) {
389
+ dp6 = (struct rerr_unreach6_draft_01 * )(void * )(ap + 1 );
390
+ for (dc = ap -> rerr_dc ; dc != 0 && i >= sizeof (* dp6 );
391
+ ++ dp6 , -- dc , i -= sizeof (* dp6 )) {
381
392
printf (" {%s}(%ld)" , ip6addr_string (& dp6 -> u_da ),
382
393
(unsigned long )EXTRACT_32BITS (& dp6 -> u_ds ));
383
394
}
384
- if (trunc )
395
+ if (( i % sizeof ( * dp6 )) != 0 )
385
396
printf ("[|rerr]" );
386
397
#else
387
398
printf (" rerr %u" , length );
@@ -391,7 +402,7 @@ aodv_v6_draft_01_rerr(const struct aodv_rerr *ap _U_, u_int length)
391
402
void
392
403
aodv_print (const u_char * dat , u_int length , int is_ip6 )
393
404
{
394
- uint8_t msg_type ;
405
+ u_int8_t msg_type ;
395
406
396
407
/*
397
408
* The message type is the first byte; make sure we have it
@@ -419,7 +430,7 @@ aodv_print(const u_char *dat, u_int length, int is_ip6)
419
430
420
431
case AODV_RERR :
421
432
if (is_ip6 )
422
- aodv_v6_rerr ((const struct aodv_rerr * )dat , length );
433
+ aodv_v6_rerr ((const struct aodv_rerr * )dat , dat , length );
423
434
else
424
435
aodv_rerr ((const struct aodv_rerr * )dat , dat , length );
425
436
break ;
@@ -437,7 +448,7 @@ aodv_print(const u_char *dat, u_int length, int is_ip6)
437
448
break ;
438
449
439
450
case AODV_V6_DRAFT_01_RERR :
440
- aodv_v6_draft_01_rerr ((const struct aodv_rerr * )dat , length );
451
+ aodv_v6_draft_01_rerr ((const struct aodv_rerr * )dat , dat , length );
441
452
break ;
442
453
443
454
case AODV_V6_DRAFT_01_RREP_ACK :
0 commit comments