CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/11/11 12:40:59
Modified files:
usr.sbin/tcpdump: print-ospf.c print-ospf6.c
Log message:
tcpdump(8): Do not loop infinitely on malformed OSPF packets
When printing a Link State Update with -v, the LSU loop trusts the
advertised LSA count and advances to the next LSA by the length field
of the LSA header. An LSA header with a length smaller than the
header itself makes the loop re-parse the same header up to 2^31
times, pinning tcpdump on one packet.
Reject an LSA whose length is smaller than the mandatory 20 byte
header in ospf_print_lsa() and ospf6_print_lsa(), where the length
is used to advance. The DD and LSAck printers only walk fixed size
headers and are unaffected.
Reported by Acts1631, thanks!
ok dlg@
