From 103d9140ae250f07f81603c4e9acc7d1b1a36730 Mon Sep 17 00:00:00 2001 From: Gerald Combs Date: Mon, 21 Sep 2020 11:47:24 -0700 Subject: [PATCH] Kafka: Check returned offsets. dissect_kafka_regular_bytes might return -1, so handle that in dissect_kafka_message_old. Closes #16784. --- epan/dissectors/packet-kafka.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/epan/dissectors/packet-kafka.c b/epan/dissectors/packet-kafka.c index ecbd9f492c..896243eee6 100644 --- a/epan/dissectors/packet-kafka.c +++ b/epan/dissectors/packet-kafka.c @@ -1886,6 +1886,7 @@ dissect_kafka_message_old(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, i tvbuff_t *decompressed_tvb; int decompressed_offset; int start_offset = offset; + int bytes_offset; gint8 magic_byte; guint8 codec; guint32 message_size; @@ -1913,7 +1914,13 @@ dissect_kafka_message_old(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, i offset += 8; } - offset = dissect_kafka_regular_bytes(subtree, hf_kafka_message_key, tvb, pinfo, offset, NULL, NULL); + bytes_offset = dissect_kafka_regular_bytes(subtree, hf_kafka_message_key, tvb, pinfo, offset, NULL, NULL); + if (bytes_offset > offset) { + offset = bytes_offset; + } else { + expert_add_info(pinfo, message_ti, &ei_kafka_bad_bytes_length); + return -1; + } /* * depending on the compression codec, the payload is the actual message payload (codes=none) @@ -1921,7 +1928,13 @@ dissect_kafka_message_old(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, i * is no such duality. */ if (codec == 0) { - offset = dissect_kafka_regular_bytes(subtree, hf_kafka_message_value, tvb, pinfo, offset, NULL, &length); + bytes_offset = dissect_kafka_regular_bytes(subtree, hf_kafka_message_value, tvb, pinfo, offset, NULL, &length); + if (bytes_offset > offset) { + offset = bytes_offset; + } else { + expert_add_info(pinfo, message_ti, &ei_kafka_bad_bytes_length); + return -1; + } } else { length = tvb_get_ntohl(tvb, offset); offset += 4;