L2TP: Add a bounds check

Check if the offset padding octets are in the packet buffer.
This commit is contained in:
Francois-Xavier Le Bail 2021-02-14 11:35:40 +01:00
parent 5757761072
commit 5d000b0773

View File

@ -807,6 +807,8 @@ l2tp_print(netdissect_options *ndo, const u_char *dat, u_int length)
if (flag_o) { /* Offset Size */
pad = GET_BE_U_2(ptr);
/* Offset padding octets in packet buffer? */
ND_TCHECK_LEN(ptr + 2, pad);
ptr += (2 + pad);
cnt += (2 + pad);
}