If "snprintf()" can't print all the data because there's not enough

room, it might return -1 in some versions of glibc; check for that, and
quit if that happens.

It might also return the number of characters that would've been printed
had there been enough room; this means that a loop that does

	n += snprintf (buf + n, BUF_LENGTH - n, ...);

may end up making "n" bigger than BUF_LENGTH, and "snprintf()" might not
sanely handle being passed a negative length, so if "n" isn't less than
the total length of the string buffer, don't add stuff to it.

The "capabilitiesStart" variable in "add_capabilities()" in the WSP
dissector is an offset into the PDU data; there's no guarantee that said
offet is < 256, and, even if there were, there's no point in making it
an 8-bit variable.

Add some additional buffer overflow checks to the WSP dissector.

svn path=/trunk/; revision=3953

1 files changed, 28 insertions, 4 deletions

diff --git a/packet-isakmp.c b/packet-isakmp.c
index a9370fbb1f..6a16781254 100644
--- a/packet-isakmp.c
+++ b/packet-isakmp.c
@@ -3,7 +3,7 @@
  * (ISAKMP) (RFC 2408)
  * Brad Robel-Forrest <brad.robel-forrest@watchguard.com>
  *
- * $Id: packet-isakmp.c,v 1.42 2001/08/31 19:47:07 guy Exp $
+ * $Id: packet-isakmp.c,v 1.43 2001/09/25 18:27:35 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -989,17 +989,41 @@ situation2str(guint32 type) {
   static char	msg[SIT_MSG_NUM];
   int		n = 0;
   char *	sep = "";
+  int		ret;
   
   if (type & SIT_IDENTITY) {
-    n += snprintf(msg, SIT_MSG_NUM-n, "%sIDENTITY", sep);
+    ret = snprintf(msg, SIT_MSG_NUM-n, "%sIDENTITY", sep);
+    if (ret == -1) {
+      /* Some versions of snprintf return -1 if they'd truncate the output. */
+      return msg;
+    }
+    n += ret;
     sep = " & ";
   }
   if (type & SIT_SECRECY) {
-    n += snprintf(msg, SIT_MSG_NUM-n, "%sSECRECY", sep);
+    if (n >= SIT_MSG_NUM) {
+      /* No more room. */
+      return msg;
+    }
+    ret = snprintf(msg, SIT_MSG_NUM-n, "%sSECRECY", sep);
+    if (ret == -1) {
+      /* Some versions of snprintf return -1 if they'd truncate the output. */
+      return msg;
+    }
+    n += ret;
     sep = " & ";
   }
   if (type & SIT_INTEGRITY) {
-    n += snprintf(msg, SIT_MSG_NUM-n, "%sINTEGRITY", sep);
+    if (n >= SIT_MSG_NUM) {
+      /* No more room. */
+      return msg;
+    }
+    ret = snprintf(msg, SIT_MSG_NUM-n, "%sINTEGRITY", sep);
+    if (ret == -1) {
+      /* Some versions of snprintf return -1 if they'd truncate the output. */
+      return msg;
+    }
+    n += ret;
     sep = " & ";
   }