commit d7d269e8c67b6e8262db27bb92ae524aa3c3f439
author Francois-Xavier Le Bail <fx.lebail@yahoo.com> Tue Oct 06 16:21:19 2015 +0200
committer Francois-Xavier Le Bail <fx.lebail@yahoo.com> Tue Oct 06 16:24:40 2015 +0200
tree 476dcccf50dc64ba890d1841bd41717912548ebc
parent a14ec7492f57a8980f06e8080b96337b9accbcab

RSVP: Fix an infinite loop

print-rsvp.c

diff --git a/print-rsvp.c b/print-rsvp.c
index 6c807fe..1a4dd42 100644
--- a/print-rsvp.c
+++ b/print-rsvp.c
@@ -29,6 +29,8 @@
 #include "af.h"
 #include "signature.h"
 
+static const char istr[] = " (invalid)";
+
 /*
  * RFC 2205 common header
  *
@@ -1170,6 +1172,9 @@
                            tok2str(af_values, "Unknown", af), af,
                            subobj_len));
 
+                    if(subobj_len == 0)
+                        goto invalid;
+
                     switch(subobj_type) {
                     case RSVP_GEN_UNI_SUBOBJ_SOURCE_TNA_ADDRESS:
                     case RSVP_GEN_UNI_SUBOBJ_DESTINATION_TNA_ADDRESS:
@@ -1769,6 +1774,9 @@
         tlen-=rsvp_obj_len;
     }
     return 0;
+invalid:
+    ND_PRINT((ndo, "%s", istr));
+    return -1;
 trunc:
     ND_PRINT((ndo, "\n\t\t packet exceeded snapshot"));
     return -1;