osmocom
/
wireshark
11
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

Fix https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7701 : 

Do sanity check on option length earlier

svn path=/trunk/; revision=44785
This commit is contained in:
Pascal Quantin 2012-09-05 21:23:50 +00:00
parent 345529250f
commit d2715d3b5f
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
epan/dissectors/packet-bootp.c
View File

@ -2093,6 +2093,10 @@ bootp_option(tvbuff_t *tvb, packet_info *pinfo, proto_tree *bp_tree, int voff,
while (optoff < optend) {
name_len = tvb_get_guint8(tvb, optoff);
string = tvb_get_ephemeral_stringz(tvb, optoff+1, &len);
if ((optoff+len+1) > optend) {
expert_add_info_format(pinfo, vti, PI_PROTOCOL, PI_ERROR, "length goes beyond option end");
break;
}
while (name_len < (len-1)) {
tmp = name_len;
name_len = name_len + string[tmp] + 1;
@ -2100,10 +2104,6 @@ bootp_option(tvbuff_t *tvb, packet_info *pinfo, proto_tree *bp_tree, int voff,
}
proto_tree_add_string(v_tree, hf_bootp_option_sip_server_name, tvb, optoff, len+1, string);
optoff += len+1;
if (optoff > optend) {
expert_add_info_format(pinfo, vti, PI_PROTOCOL, PI_ERROR, "length goes beyond option end");
break;
}
}
}
break;