Do bounds checks on NBNS resource types and resource data lengths.

This commit is contained in:
Guy Harris 2016-10-05 19:43:27 -07:00 committed by Francois-Xavier Le Bail
parent df60a6c956
commit ecf6e822e1

View File

@ -1167,10 +1167,12 @@ nbt_udp137_print(netdissect_options *ndo,
p = smb_fdata(ndo, p, "Name=[n1]\n#", maxbuf, 0);
if (p == NULL)
goto out;
ND_TCHECK_16BITS(p);
restype = EXTRACT_16BITS(p);
p = smb_fdata(ndo, p, "ResType=[rw]\nResClass=[rw]\nTTL=[rD]\n", p + 8, 0);
if (p == NULL)
goto out;
ND_TCHECK_16BITS(p);
rdlen = EXTRACT_16BITS(p);
ND_PRINT((ndo, "ResourceLength=%d\nResourceData=\n", rdlen));
p += 2;