commit 79d80f09f3852799cf2fdfa8667138e92d1e0e5d
author Francois-Xavier Le Bail <fx.lebail@yahoo.com> Fri Oct 07 18:08:42 2016 +0200
committer Francois-Xavier Le Bail <fx.lebail@yahoo.com> Wed Jan 18 09:16:40 2017 +0100
tree 21e07c5e826f0bc3fdccd9ce3d37e6113358a29e
parent ec9d8470370d866ca0507a8bef0b0cb4a9296b04

SNMP: Add some bounds checks

print-snmp.c

diff --git a/print-snmp.c b/print-snmp.c
index c97141e..b3ef26c 100644
--- a/print-snmp.c
+++ b/print-snmp.c
@@ -447,13 +447,18 @@
 		 * bit set.  XXX - this doesn't handle a value
 		 * that won't fit in 32 bits.
 		 */
-		for (id = 0; *p & ASN_BIT8; len--, hdr++, p++) {
+		id = 0;
+		ND_TCHECK(*p);
+		while (*p & ASN_BIT8) {
 			if (len < 1) {
 				ND_PRINT((ndo, "[Xtagfield?]"));
 				return -1;
 			}
-			ND_TCHECK(*p);
 			id = (id << 7) | (*p & ~ASN_BIT8);
+			len--;
+			hdr++;
+			p++;
+			ND_TCHECK(*p);
 		}
 		if (len < 1) {
 			ND_PRINT((ndo, "[Xtagfield?]"));