"plen" and "len" are of type "u_int" and never negative.

Index: usr.sbin/tcpdump/print-bgp.c
===================================================================
RCS file: /cvs/src/usr.sbin/tcpdump/print-bgp.c,v
retrieving revision 1.21
diff -u -p -r1.21 print-bgp.c
--- usr.sbin/tcpdump/print-bgp.c        24 Apr 2017 20:35:35 -0000      1.21
+++ usr.sbin/tcpdump/print-bgp.c        29 May 2017 10:08:40 -0000
@@ -356,7 +356,7 @@ decode_prefix4(const u_char *pd, char *b
                       * enough bytes of address to contain this many bits
                       */
        plen = pd[0];
-       if (plen < 0 || 32 < plen)
+       if (32 < plen)
                return -1;
        memset(&addr, 0, sizeof(addr));
        TCHECK2(pd[1], (plen + 7) / 8);
@@ -385,7 +385,7 @@ decode_prefix6(const u_char *pd, char *b
 
        TCHECK(pd[0]);
        plen = pd[0];
-       if (plen < 0 || 128 < plen)
+       if (128 < plen)
                return -1;
 
        memset(&addr, 0, sizeof(addr));
Index: usr.sbin/tcpdump/print-wb.c
===================================================================
RCS file: /cvs/src/usr.sbin/tcpdump/print-wb.c,v
retrieving revision 1.9
diff -u -p -r1.9 print-wb.c
--- usr.sbin/tcpdump/print-wb.c 16 Nov 2015 00:16:39 -0000      1.9
+++ usr.sbin/tcpdump/print-wb.c 29 May 2017 10:08:40 -0000
@@ -180,7 +180,7 @@ wb_id(const struct pkt_id *id, u_int len
 
        printf(" wb-id:");
        len -= sizeof(*id);
-       if (len < 0 || (u_char *)(id + 1) > snapend)
+       if ((u_char *)(id + 1) > snapend)
                return (-1);
 
        printf(" %u/%s:%u (max %u/%s:%u) ",
@@ -336,7 +336,7 @@ wb_rrep(const struct pkt_rrep *rrep, u_i
 
        printf(" wb-rrep:");
        len -= sizeof(*rrep);
-       if (len < 0 || (u_char *)(rrep + 1) > snapend)
+       if ((u_char *)(rrep + 1) > snapend)
                return (-1);
 
        printf(" for %s %s:%u<%u:%u>",
@@ -357,7 +357,7 @@ wb_drawop(const struct pkt_dop *dop, u_i
 {
        printf(" wb-dop:");
        len -= sizeof(*dop);
-       if (len < 0 || (u_char *)(dop + 1) > snapend)
+       if ((u_char *)(dop + 1) > snapend)
                return (-1);
 
        printf(" %s:%u<%u:%u>",
@@ -382,7 +382,7 @@ wb_print(const void *hdr, u_int len)
 
        ph = (const struct pkt_hdr *)hdr;
        len -= sizeof(*ph);
-       if (len < 0 || (u_char *)(ph + 1) <= snapend) {
+       if ((u_char *)(ph + 1) <= snapend) {
                if (ph->ph_flags)
                        printf("*");
                switch (ph->ph_type) {

-- 
Michal Mazurek

Reply via email to