osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity

Don't fail if a pcap-NG PB or EPB has caplen > actual len. 

We don't fail for other file types; there's no point in failing for
pcap-NG.  wtap_read() will ensure that caplen <= len.

Make wtap_seek_read() ensure that caplen <= len as well.

Fixes bug 10037.

Change-Id: I41fbcf54341ea0429cef875442ea1f1377177a5f
Reviewed-on: https://code.wireshark.org/review/1353
Reviewed-by: Guy Harris <guy@alum.mit.edu>
This commit is contained in:
Guy Harris 2014-04-25 10:44:11 -07:00
parent 83fe3572c5
commit 6d6094e349
2 changed files with 19 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
wiretap/pcapng.c
View File

@ -1090,12 +1090,6 @@ pcapng_read_packet_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *pn, wta
}
}
if (packet.cap_len > packet.packet_len) {
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("pcapng_read_packet_block: cap_len %u is larger than packet_len %u",
packet.cap_len, packet.packet_len);
return 0;
}
if (packet.cap_len > WTAP_MAX_PACKET_SIZE) {
*err = WTAP_ERR_BAD_FILE;
*err_info = g_strdup_printf("pcapng_read_packet_block: cap_len %u is larger than WTAP_MAX_PACKET_SIZE %u",

20
wiretap/wtap.c
View File

@ -1075,5 +1075,23 @@ gboolean
wtap_seek_read(wtap *wth, gint64 seek_off,
struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info)
{
return wth->subtype_seek_read(wth, seek_off, phdr, buf, err, err_info);
if (!wth->subtype_seek_read(wth, seek_off, phdr, buf, err, err_info))
return FALSE;
/*
* It makes no sense for the captured data length to be bigger
* than the actual data length.
*/
if (wth->phdr.caplen > wth->phdr.len)
wth->phdr.caplen = wth->phdr.len;
/*
* Make sure that it's not WTAP_ENCAP_PER_PACKET, as that
* probably means the file has that encapsulation type
* but the read routine didn't set this packet's
* encapsulation type.
*/
g_assert(wth->phdr.pkt_encap != WTAP_ENCAP_PER_PACKET);
return TRUE;
}