osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity

ncp2222: don't overflow buffer constructing string 

Fixes stack-smashing vuln.

Somehow there was already an XXX in the code about this, but nobody realized at
the time it was worth fixing... really?

Bug: 10552
Change-Id: I849068bd6c45146339444f295b72430d3c6e08f2
Reviewed-on: https://code.wireshark.org/review/4653
Reviewed-by: Evan Huus <eapache@gmail.com>
This commit is contained in:
Evan Huus 2014-10-13 12:55:40 -04:00
parent 8fb74b4a68
commit b9988e2bbf
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
epan/dissectors/packet-ncp2222.inc
View File

@ -2755,8 +2755,7 @@ build_expert_data(proto_tree *ncp_tree, const char *hf_name, char *buffer,
case 18:
case 19:
case 20: /* string */
/* XXX: Should we verify: buffer_size is as large as value returned by get_finfo_length(...) ??? */
uni_to_string(get_finfo_value_string(PTREE_FINFO(tree_pointer)), get_finfo_length(PTREE_FINFO(tree_pointer)), buffer);
uni_to_string(get_finfo_value_string(PTREE_FINFO(tree_pointer)), MIN(get_finfo_length(PTREE_FINFO(tree_pointer)), buffer_size), buffer);
if (repeat_lookup > 0) {
if (strlen(temp_buffer) + strlen(buffer) < 250) {
g_strlcat(temp_buffer, buffer, 256);