tcpdump/tests/calm-fast-mac-lookup-heapoverflow.out
Francois-Xavier Le Bail 5ee4e508de ASCII/hex: Use nd_trunc_longjmp() in truncation cases
In functions ascii_print(), hex_and_ascii_print_with_offset() and
hex_print_with_offset().
Therefore indirectly for the functions hex_and_ascii_print(), hex_print()
and ndo_default_print().

Even if hex_and_ascii_print(), hex_print() and ascii_print() are used in
print.c after the setjmp() block with the calls:

1) hex_and_ascii_print(ndo, "\n\t", sp, h->caplen);
2) hex_and_ascii_print(ndo, "\n\t", sp + hdrlen, h->caplen - hdrlen);
3) hex_print(ndo, "\n\t", sp, h->caplen);
4) hex_print(ndo, "\n\t", sp + hdrlen, h->caplen - hdrlen);
5) ascii_print(ndo, sp, h->caplen);
6) ascii_print(ndo, sp + hdrlen, h->caplen - hdrlen);

sp and h->caplen are unmodified, ndo->ndo_snapend was restored.

1), 3) and 5) the length to print is caplen => no truncation can occur.
2), 4) and 6) the length to print is (caplen - hdrlen) after a shift of
hdrlen => no truncation can occur.

Moreover:
Update the output of three tests accordingly.
Remove an useless comment.
Fix indentation.
2021-03-27 20:54:29 +01:00

6 lines
324 B
Plaintext

1 05:27:12.808464432 Q.922, invalid address
2 05:27:12.808464432 CALM FAST; SrcNwref:48; DstNwref:48;
0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
0x0010: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000
0x0020: 3030 3030 3030 3030 3030 0000000000 [|calm_fast]