osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity

IEEE 802.11: fix an infinite loop 

Presumably the element length is unsigned, otherwise it can be negative
and reincrement tag length.

Bug: 14231
Change-Id: I26d339aea7588a489b4252b67c212810029bff0e
Reviewed-on: https://code.wireshark.org/review/24472
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Michael Mann <mmann78@netscape.net>
This commit is contained in:
Pascal Quantin 2017-11-17 23:09:09 +01:00 committed by Michael Mann
parent 658578a5b9
commit ed68e05014
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
epan/dissectors/packet-ieee80211.c
View File

@ -13146,7 +13146,7 @@ dissect_measurement_pilot_trans_ie(tvbuff_t *tvb, packet_info *pinfo _U_, proto_
if (tag_len > 0) {
while (tag_len > 0) {
gint8 elt_len = 0;
guint8 elt_len;
elt_len = tvb_get_guint8(tvb, offset + 1);