X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fplugins%2Fcdp%2Fcdp_input.c;h=a27113d18eb6b83fca99bea13eb46266e81f28c8;hb=3206bb15aa65f6b4bd933844cffc26967aab6ed6;hp=dd3619cb8acd5a8120a738ce6810dac231e5bfbe;hpb=55c6c4a422f34365b2c32ad0a107a058aa64fd8d;p=vpp.git

diff --git a/src/plugins/cdp/cdp_input.c b/src/plugins/cdp/cdp_input.c
index dd3619cb8ac..a27113d18eb 100644
--- a/src/plugins/cdp/cdp_input.c
+++ b/src/plugins/cdp/cdp_input.c
@@ -93,8 +93,11 @@ format_text_tlv (u8 * s, va_list * va)
 
   s = format (s, "%s(%d): ", h->name, t->t);
 
-  for (i = 0; i < (t->l - sizeof (*t)); i++)
-    vec_add1 (s, t->v[i]);
+  if (t->l >= 4)
+    {
+      for (i = 0; i < (t->l - sizeof (*t)); i++)
+	vec_add1 (s, t->v[i]);
+    }
 
   vec_add1 (s, '\n');
   return s;
@@ -284,9 +287,14 @@ cdp_packet_scan (cdp_main_t * cm, cdp_neighbor_t * n)
       tlv->l = ntohs (tlv->l);
 
       /* tlv length includes t, l and v */
+
+      if (tlv->l < 4)
+	return CDP_ERROR_BAD_TLV;
+
       cur += tlv->l;
       if ((cur - 1) > end)
 	return CDP_ERROR_BAD_TLV;
+
       /*
        * Only process known TLVs. In practice, certain
        * devices send tlv->t = 0xFF, perhaps as an EOF of sorts.