From 5bd63cdae9dba47a066fc50264707ebc33634827 Mon Sep 17 00:00:00 2001
From: "7u83@mail.ru" <7u83@mail.ru@noemail.net>
Date: Sun, 17 Aug 2014 09:36:49 +0000
Subject: [PATCH] Does a lot of error checking now.

FossilOrigin-Name: 9efb5330eea7b66ca2fcbe0c41826d40e3c8695a45dba8e656ff95a0cdad5b6c
---
 src/capwap/hdr_print.c | 49 ++++++++++++++++++++++++++++++++++++------
 1 file changed, 43 insertions(+), 6 deletions(-)

diff --git a/src/capwap/hdr_print.c b/src/capwap/hdr_print.c
index 69356893..08e6dffd 100644
--- a/src/capwap/hdr_print.c
+++ b/src/capwap/hdr_print.c
@@ -32,11 +32,30 @@ int hdr_print(char *str, uint8_t *packet, int len)
 
 	char *s = str;
 
-	if (CWTH_GET_PREAMBLE(packet)==01){
+
+	if (len<1){
+		s+=sprintf(s,"\tNo info available.");
+		return s-str;
+	}
+
+	int preamble = CWTH_GET_PREAMBLE(packet);
+	if (preamble==01){
 		s+=sprintf(s,"\tEncrypted data.");
 		return s-str;
 	}
 
+	if (preamble!=00){
+		s+=sprintf(s,"\tWrong CAPWAP version or encryption type.");
+		return s-str;
+	}
+
+
+	if (len < 4){
+		s+=sprintf(s,"\tNo more data. Packet too short.");
+		return s-str;
+	}
+	
+
 
 	int hlen = CWTH_GET_HLEN(packet);
 	int rid = CWTH_GET_RID(packet);
@@ -54,20 +73,38 @@ int hdr_print(char *str, uint8_t *packet, int len)
 				CWTH_GET_FLAG_K(packet)
 		);
 
+
+	if (len < 8){
+		s+=sprintf(s,"\tNo more data. Packet too short.");
+		return s-str;
+	}
+	
 	int frag_id = CWTH_GET_FRAGID(packet);
 	int frag_offs = CWTH_GET_FRAGOFFSET(packet);
+	s+=sprintf(s,"\tFrag Id: %d, Frag Offs:: %d\n",frag_id,frag_offs);
 
 
 	int bhlen = 4*hlen;
+
+	
+	if (len<bhlen+4){
+		s+=sprintf(s,"\tNo more data. Packet too short.");
+		return s-str;
+	}
+
+
 	int msgtype = ntohl(*((uint32_t*)(packet+bhlen)));
+	s+=sprintf(s,"\tMsgType: %d",msgtype);
+
+	if (len<bhlen+8){
+		s+=sprintf(s,"\n\tNo more data. Packet too short.");
+		return s-str;
+	}
+
 	int seqnum = (ntohl(*((uint32_t*)(packet+bhlen+4))))>>24;
 	int msgelemlen = 0xFF & ((ntohl(*((uint32_t*)(packet+bhlen+4))))>>8);
 
-	s+=sprintf(s,"\tFrag Id: %d, Frag Offs:: %d\n",frag_id,frag_offs);
-	s+=sprintf(s,"\tMsgType: %d, SeqNum: %d, MsgelemLen:%d\n",msgtype,seqnum,msgelemlen);
-
-
-
+	s+=sprintf(s,", SeqNum: %d, MsgelemLen:%d\n",seqnum,msgelemlen);
 
 
 	return s-str;