From: Beniamino Galvani <bgalvani@redhat.com>
Date: Tue, 29 Sep 2015 15:48:37 +0000 (+0200)
Subject: lldp: fix parsing of TLV length
X-Git-Tag: v227~29^2~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=29eca2ff897dfbac65ef401515effb055da65339;p=thirdparty%2Fsystemd.git

lldp: fix parsing of TLV length

tlv_packet_read_bytes() and tlv_packet_read_string() returned the
wrong length when called after other functions which modify the offset
in the container.

In other words, if the TLV data length is X and we do a
tlv_packet_read_u8(), a subsequent tlv_packet_read_bytes() should
return a length of (X - 1).
---

diff --git a/src/libsystemd-network/lldp-tlv.c b/src/libsystemd-network/lldp-tlv.c
index 4130f1adf78..66af22e37dd 100644
--- a/src/libsystemd-network/lldp-tlv.c
+++ b/src/libsystemd-network/lldp-tlv.c
@@ -240,9 +240,9 @@ int tlv_packet_read_string(tlv_packet *m, char **data, uint16_t *data_length) {
                 return r;
 
         *data = (char *) val;
-        *data_length = m->container->length;
+        *data_length = m->container->data + m->container->length - m->container->read_pos;
 
-        m->container->read_pos += m->container->length;
+        m->container->read_pos += *data_length;
 
         return 0;
 }
@@ -258,9 +258,9 @@ int tlv_packet_read_bytes(tlv_packet *m, uint8_t **data, uint16_t *data_length)
                 return r;
 
         *data = (uint8_t *) val;
-        *data_length = m->container->length;
+        *data_length = m->container->data + m->container->length - m->container->read_pos;
 
-        m->container->read_pos += m->container->length;
+        m->container->read_pos += *data_length;
 
         return 0;
 }
@@ -336,7 +336,7 @@ int lldp_tlv_packet_enter_container(tlv_packet *m, uint16_t type) {
 
         m->container->read_pos = s->data;
         if (!m->container->read_pos) {
-                m->container = 0;
+                m->container = NULL;
                 return -1;
         }
 
@@ -364,7 +364,7 @@ int lldp_tlv_packet_enter_container_oui(tlv_packet *m, const uint8_t *oui, uint8
 
         m->container->read_pos = s->data;
         if (!m->container->read_pos) {
-                m->container = 0;
+                m->container = NULL;
                 return -1;
         }