osmocom
/
wireshark
11
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

openflow_v6: Prevent infinite loops in too short ofp_stats 

The ofp_stats struct length field includes the fixed 4 bytes.
If the length is smaller than that, report the length error
and break out. In particular, a value of zero can cause
infinite loops if this isn't done.
This commit is contained in:
John Thacker 2022-12-01 20:46:15 -05:00
parent 0e11932183
commit 13823bb105
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
epan/dissectors/packet-openflow_v6.c
View File

@ -1119,17 +1119,23 @@ dissect_openflow_v6_oxs(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree,
static int static int
dissect_openflow_stats_v6(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, guint16 length _U_) dissect_openflow_stats_v6(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, guint16 length _U_)
{ {
proto_item *ti;
guint32 stats_length; guint32 stats_length;
int oxs_end; int oxs_end;
guint32 padding; guint32 padding;
proto_tree_add_item(tree, hf_openflow_v6_stats_reserved, tvb, offset, 2, ENC_NA); proto_tree_add_item(tree, hf_openflow_v6_stats_reserved, tvb, offset, 2, ENC_NA);
proto_tree_add_item_ret_uint(tree, hf_openflow_v6_stats_length, tvb, offset+2, 2, ENC_BIG_ENDIAN, &stats_length); ti = proto_tree_add_item_ret_uint(tree, hf_openflow_v6_stats_length, tvb, offset+2, 2, ENC_BIG_ENDIAN, &stats_length);
oxs_end = offset + stats_length; oxs_end = offset + stats_length;
offset+=4; offset+=4;
if (stats_length < 4) {
expert_add_info(pinfo, ti, &ei_openflow_v6_length_too_short);
return offset;
}
while (offset < oxs_end) { while (offset < oxs_end) {
offset = dissect_openflow_v6_oxs(tvb, pinfo, tree, offset, oxs_end - offset); offset = dissect_openflow_v6_oxs(tvb, pinfo, tree, offset, oxs_end - offset);
} }