osmocom
/
wireshark
11
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

SNMP: duplicate dynamic members of snmp_ue_assoc_t structure in localize_ue() 

Otherwise you can end up freeing twice the same memory blocks
(from localized_ues and unlocalized_ues lists)

Bug: 13420
Change-Id: I7e6f1f8d740b0e5ffca851f3f5b1928a7686c069
Reviewed-on: https://code.wireshark.org/review/20190
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Jaap Keuter <jaap.keuter@xs4all.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
This commit is contained in:
Pascal Quantin 2017-02-19 21:41:55 +01:00 committed by Alexis La Goutte
parent e2e4415c9f
commit 1089211c0b
2 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
epan/dissectors/asn1/snmp/packet-snmp-template.c
View File

@ -1467,6 +1467,11 @@ localize_ue( snmp_ue_assoc_t* o, const guint8* engine, guint engine_len )
{
snmp_ue_assoc_t* n = (snmp_ue_assoc_t*)g_memdup(o,sizeof(snmp_ue_assoc_t));
n->user.userName.data = (guint8*)g_memdup(o->user.userName.data,o->user.userName.len);
n->user.authPassword.data = (guint8*)g_memdup(o->user.authPassword.data,o->user.authPassword.len);
n->user.privPassword.data = (guint8*)g_memdup(o->user.privPassword.data,o->user.privPassword.len);
n->user.authKey.data = (guint8*)g_memdup(o->user.authKey.data,o->user.authKey.len);
n->user.privKey.data = (guint8*)g_memdup(o->user.privKey.data,o->user.privKey.len);
n->engine.data = (guint8*)g_memdup(engine,engine_len);
n->engine.len = engine_len;

11
epan/dissectors/packet-snmp.c
View File

@ -1569,6 +1569,11 @@ localize_ue( snmp_ue_assoc_t* o, const guint8* engine, guint engine_len )
{
snmp_ue_assoc_t* n = (snmp_ue_assoc_t*)g_memdup(o,sizeof(snmp_ue_assoc_t));
n->user.userName.data = (guint8*)g_memdup(o->user.userName.data,o->user.userName.len);
n->user.authPassword.data = (guint8*)g_memdup(o->user.authPassword.data,o->user.authPassword.len);
n->user.privPassword.data = (guint8*)g_memdup(o->user.privPassword.data,o->user.privPassword.len);
n->user.authKey.data = (guint8*)g_memdup(o->user.authKey.data,o->user.authKey.len);
n->user.privKey.data = (guint8*)g_memdup(o->user.privKey.data,o->user.privKey.len);
n->engine.data = (guint8*)g_memdup(engine,engine_len);
n->engine.len = engine_len;
@ -3046,7 +3051,7 @@ static int dissect_SMUX_PDUs_PDU(tvbuff_t *tvb _U_, packet_info *pinfo _U_, prot
/*--- End of included file: packet-snmp-fn.c ---*/
#line 1841 "./asn1/snmp/packet-snmp-template.c"
#line 1846 "./asn1/snmp/packet-snmp-template.c"
guint
@ -3863,7 +3868,7 @@ void proto_register_snmp(void) {
NULL, HFILL }},
/*--- End of included file: packet-snmp-hfarr.c ---*/
#line 2393 "./asn1/snmp/packet-snmp-template.c"
#line 2398 "./asn1/snmp/packet-snmp-template.c"
};
/* List of subtrees */
@ -3903,7 +3908,7 @@ void proto_register_snmp(void) {
&ett_snmp_RReqPDU_U,
/*--- End of included file: packet-snmp-ettarr.c ---*/
#line 2409 "./asn1/snmp/packet-snmp-template.c"
#line 2414 "./asn1/snmp/packet-snmp-template.c"
};
static ei_register_info ei[] = {
{ &ei_snmp_failed_decrypted_data_pdu, { "snmp.failed_decrypted_data_pdu", PI_MALFORMED, PI_WARN, "Failed to decrypt encryptedPDU", EXPFILL }},