git: 4848eb3af2a9 - main - tcpdump: cope with incorrect packet lengths

The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=4848eb3af2a91b133c4b70cb9b71dd92ffec7f46

commit 4848eb3af2a91b133c4b70cb9b71dd92ffec7f46
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2024-04-01 09:42:14 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2024-04-04 08:07:05 +0000

    tcpdump: cope with incorrect packet lengths
    
    It's possible for the capture buffer to be smaller than indicated by the
    header length. However, pfsync_print() only took the header length into
    account. As a result we could read outside of the buffer.
    
    Check that we have at least the expected amount of data before we start
    parsing.
    
    PR:             278034
    MFC after:      2 weeks
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    Differential Revision:  https://reviews.freebsd.org/D44580
---
 contrib/tcpdump/print-pfsync.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/contrib/tcpdump/print-pfsync.c b/contrib/tcpdump/print-pfsync.c
index 5710e36ded6c..6bf9abaf3903 100644
--- a/contrib/tcpdump/print-pfsync.c
+++ b/contrib/tcpdump/print-pfsync.c
@@ -86,7 +86,7 @@ pfsync_ip_print(netdissect_options *ndo , const u_char *bp, u_int len)
 {
 	struct pfsync_header *hdr = (struct pfsync_header *)bp;
 
-	if (len < PFSYNC_HDRLEN)
+	if (len < PFSYNC_HDRLEN || !ND_TTEST_LEN(bp, len))
 		ND_PRINT("[|pfsync]");
 	else
 		pfsync_print(ndo, hdr, bp + sizeof(struct pfsync_header),