"plen" and "len" are of type "u_int" and never negative.
Index: usr.sbin/tcpdump/print-bgp.c =================================================================== RCS file: /cvs/src/usr.sbin/tcpdump/print-bgp.c,v retrieving revision 1.21 diff -u -p -r1.21 print-bgp.c --- usr.sbin/tcpdump/print-bgp.c 24 Apr 2017 20:35:35 -0000 1.21 +++ usr.sbin/tcpdump/print-bgp.c 29 May 2017 10:08:40 -0000 @@ -356,7 +356,7 @@ decode_prefix4(const u_char *pd, char *b * enough bytes of address to contain this many bits */ plen = pd[0]; - if (plen < 0 || 32 < plen) + if (32 < plen) return -1; memset(&addr, 0, sizeof(addr)); TCHECK2(pd[1], (plen + 7) / 8); @@ -385,7 +385,7 @@ decode_prefix6(const u_char *pd, char *b TCHECK(pd[0]); plen = pd[0]; - if (plen < 0 || 128 < plen) + if (128 < plen) return -1; memset(&addr, 0, sizeof(addr)); Index: usr.sbin/tcpdump/print-wb.c =================================================================== RCS file: /cvs/src/usr.sbin/tcpdump/print-wb.c,v retrieving revision 1.9 diff -u -p -r1.9 print-wb.c --- usr.sbin/tcpdump/print-wb.c 16 Nov 2015 00:16:39 -0000 1.9 +++ usr.sbin/tcpdump/print-wb.c 29 May 2017 10:08:40 -0000 @@ -180,7 +180,7 @@ wb_id(const struct pkt_id *id, u_int len printf(" wb-id:"); len -= sizeof(*id); - if (len < 0 || (u_char *)(id + 1) > snapend) + if ((u_char *)(id + 1) > snapend) return (-1); printf(" %u/%s:%u (max %u/%s:%u) ", @@ -336,7 +336,7 @@ wb_rrep(const struct pkt_rrep *rrep, u_i printf(" wb-rrep:"); len -= sizeof(*rrep); - if (len < 0 || (u_char *)(rrep + 1) > snapend) + if ((u_char *)(rrep + 1) > snapend) return (-1); printf(" for %s %s:%u<%u:%u>", @@ -357,7 +357,7 @@ wb_drawop(const struct pkt_dop *dop, u_i { printf(" wb-dop:"); len -= sizeof(*dop); - if (len < 0 || (u_char *)(dop + 1) > snapend) + if ((u_char *)(dop + 1) > snapend) return (-1); printf(" %s:%u<%u:%u>", @@ -382,7 +382,7 @@ wb_print(const void *hdr, u_int len) ph = (const struct pkt_hdr *)hdr; len -= sizeof(*ph); - if (len < 0 || (u_char *)(ph + 1) <= snapend) { + if ((u_char *)(ph + 1) <= snapend) { if (ph->ph_flags) printf("*"); switch (ph->ph_type) { -- Michal Mazurek