src/patches/tcpdump-3.8.2-rsvp-dos.patch

   1 borrowed from fedora
   2 fix for CAN-2005-1280
   3
   4 --- tcpdump-3.8.2/print-rsvp.c.old      2004-03-24 05:00:38.000000000 +0100
   5 +++ tcpdump-3.8.2/print-rsvp.c          2005-04-27 17:09:34.000000000 +0200
   6 @@ -872,6 +872,8 @@
   7
   8          case RSVP_OBJ_RRO:
   9          case RSVP_OBJ_ERO:
  10 +            {
  11 +            int step;
  12              switch(rsvp_obj_ctype) {
  13              case RSVP_CTYPE_IPV4:
  14                  while(obj_tlen >= 4 ) {
  15 @@ -889,15 +891,16 @@
  16                                     "none",
  17                                     *(obj_tptr+7))); /* rfc3209 says that this field is rsvd. */
  18                      }
  19 -                    obj_tlen-=*(obj_tptr+1);
  20 -                    obj_tptr+=*(obj_tptr+1);
  21 +                    step = *(obj_tptr+1) ? *(obj_tptr+1) : obj_tlen;
  22 +                    obj_tlen -= step;
  23 +                    obj_tptr += step;
  24                  }
  25                  break;
  26              default:
  27                  hexdump=TRUE;
  28              }
  29              break;
  30 -
  31 +            }
  32          case RSVP_OBJ_HELLO:
  33              switch(rsvp_obj_ctype) {
  34              case RSVP_CTYPE_1: