forked from osmocom/wireshark
MS-WSP: Don't allocate huge amounts of memory.
Add a couple of memory allocation sanity checks, one of which
fixes #17331.
(cherry picked from commit b7a0650e06
)
This commit is contained in:
parent
19d03ef4ac
commit
04f9d3e097
|
@ -313,8 +313,10 @@ struct CTableColumn {
|
||||||
guint16 lengthoffset;
|
guint16 lengthoffset;
|
||||||
char name[PROP_LENGTH];
|
char name[PROP_LENGTH];
|
||||||
};
|
};
|
||||||
/* minimum size in bytes on the wire CTableColumn can be */
|
/* Minimum size in bytes on the wire CTableColumn can be */
|
||||||
#define MIN_CTABLECOL_SIZE 32
|
#define MIN_CTABLECOL_SIZE 32
|
||||||
|
/* Maximum sane size in bytes on the wire CTableColumn can be. Arbitrary. */
|
||||||
|
#define MAX_CTABLECOL_SIZE 5000
|
||||||
|
|
||||||
/* 2.2.3.10 */
|
/* 2.2.3.10 */
|
||||||
|
|
||||||
|
@ -3973,6 +3975,8 @@ static int vvalue_tvb_lpwstr(tvbuff_t *tvb, int offset, void *val)
|
||||||
return 4 + vvalue_tvb_lpwstr_len(tvb, offset + 4, 0, val);
|
return 4 + vvalue_tvb_lpwstr_len(tvb, offset + 4, 0, val);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/* Maximum sane vector size. Arbitrary. */
|
||||||
|
#define MAX_VT_VECTOR_SIZE 5000
|
||||||
static int vvalue_tvb_vector_internal(tvbuff_t *tvb, int offset, struct vt_vector *val, struct vtype_data *type, guint num)
|
static int vvalue_tvb_vector_internal(tvbuff_t *tvb, int offset, struct vt_vector *val, struct vtype_data *type, guint num)
|
||||||
{
|
{
|
||||||
const int offset_in = offset;
|
const int offset_in = offset;
|
||||||
|
@ -3987,18 +3991,14 @@ static int vvalue_tvb_vector_internal(tvbuff_t *tvb, int offset, struct vt_vecto
|
||||||
* here, before making a possibly-doomed attempt to allocate
|
* here, before making a possibly-doomed attempt to allocate
|
||||||
* memory for it.
|
* memory for it.
|
||||||
*
|
*
|
||||||
* First, check for an overflow.
|
* First, check for sane values.
|
||||||
*/
|
*/
|
||||||
if ((guint64)elsize * (guint64)num > G_MAXUINT) {
|
if (num > MAX_VT_VECTOR_SIZE) {
|
||||||
/*
|
|
||||||
* We never have more than G_MAXUINT bytes in a tvbuff,
|
|
||||||
* so this will *definitely* fail.
|
|
||||||
*/
|
|
||||||
THROW(ReportedBoundsError);
|
THROW(ReportedBoundsError);
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* No overflow; now make sure we at least have that data.
|
* No huge numbers from the wire; now make sure we at least have that data.
|
||||||
*/
|
*/
|
||||||
tvb_ensure_bytes_exist(tvb, offset, elsize * num);
|
tvb_ensure_bytes_exist(tvb, offset, elsize * num);
|
||||||
|
|
||||||
|
@ -5859,7 +5859,7 @@ static int dissect_CPMSetBindings(tvbuff_t *tvb, packet_info *pinfo, proto_tree
|
||||||
|
|
||||||
/* Sanity check size value */
|
/* Sanity check size value */
|
||||||
column_size = num*MIN_CTABLECOL_SIZE;
|
column_size = num*MIN_CTABLECOL_SIZE;
|
||||||
if (column_size > tvb_reported_length_remaining(tvb, offset))
|
if (num > MAX_CTABLECOL_SIZE || column_size > tvb_reported_length_remaining(tvb, offset))
|
||||||
{
|
{
|
||||||
expert_add_info(pinfo, ti, &ei_mswsp_msg_cpmsetbinding_ccolumns);
|
expert_add_info(pinfo, ti, &ei_mswsp_msg_cpmsetbinding_ccolumns);
|
||||||
return tvb_reported_length(tvb);
|
return tvb_reported_length(tvb);
|
||||||
|
|
Loading…
Reference in New Issue