diff options
| author | Peter Wu <peter@lekensteyn.nl> | 2014-07-03 11:25:21 +0200 |
|---|---|---|
| committer | Michael Mann <mmann78@netscape.net> | 2014-07-03 13:02:24 +0000 |
| commit | 16f8ba1bed579344df373bf38fff552ab8baf380 (patch) | |
| tree | c230ab59717d869726e5db9481c5bffc765c6ac3 | |
| parent | 6ed95406e308efa2d6346ebef2468eaea051fd01 (diff) | |
catapult,irda: Fix ASAN crashes due to buffer underrun
The catapult dissector tripped on this random file I had. A quick look
at other dissectors which use a construct like "-1] *= '*\\[rn]" showed
packet-irda too, so fix that as well.
Change-Id: I4b5fadcacd0b09d0fb29bdefc3dd1f28aef9b593
Reviewed-on: https://code.wireshark.org/review/2802
Reviewed-by: Evan Huus <eapache@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
| -rw-r--r-- | plugins/irda/packet-irda.c | 6 | ||||
| -rw-r--r-- | wiretap/catapult_dct2000.c | 4 |
2 files changed, 5 insertions, 5 deletions
diff --git a/plugins/irda/packet-irda.c b/plugins/irda/packet-irda.c index 1fb280f813..add449589c 100644 --- a/plugins/irda/packet-irda.c +++ b/plugins/irda/packet-irda.c @@ -1651,14 +1651,14 @@ static void dissect_log(tvbuff_t* tvb, packet_info* pinfo, proto_tree* root) char buf[256]; - length = tvb_length(tvb); + length = tvb_captured_length(tvb); if (length > sizeof(buf)-1) length = sizeof(buf)-1; tvb_memcpy(tvb, buf, 0, length); buf[length] = 0; - if (buf[length-1] == '\n') + if (length > 0 && buf[length-1] == '\n') buf[length-1] = 0; - else if (buf[length-2] == '\n') + else if (length > 1 && buf[length-2] == '\n') buf[length-2] = 0; col_add_str(pinfo->cinfo, COL_INFO, buf); diff --git a/wiretap/catapult_dct2000.c b/wiretap/catapult_dct2000.c index be9b75eeee..c8cf46d53b 100644 --- a/wiretap/catapult_dct2000.c +++ b/wiretap/catapult_dct2000.c @@ -805,12 +805,12 @@ read_new_line(FILE_T fh, gint64 *offset, gint *length, *offset = *offset + *length; /* ...but don't want to include newline in line length */ - if (linebuff[*length-1] == '\n') { + if (*length > 0 && linebuff[*length-1] == '\n') { linebuff[*length-1] = '\0'; *length = *length - 1; } /* Nor do we want '\r' (as will be written when log is created on windows) */ - if (linebuff[*length-1] == '\r') { + if (*length > 0 && linebuff[*length-1] == '\r') { linebuff[*length-1] = '\0'; *length = *length - 1; } |