diff options
| author | Pascal Quantin <pascal.quantin@gmail.com> | 2018-03-09 13:47:42 +0100 |
|---|---|---|
| committer | Anders Broman <a.broman58@gmail.com> | 2018-03-09 14:11:24 +0000 |
| commit | cc795d4ddfaca382bcd0e6b4862a432eddd06f54 (patch) | |
| tree | 7de932f511b26fdc989e914f11f99dd38ae005a4 | |
| parent | 1ac90d5254e9e303196c100039b7dd26d23841d1 (diff) | |
WSP: check tvb_get_guintvar() success
4630b4fcf8 sets octetCount to 0 in case of error. Let's check this
return value to avoid an infinite loop
Bug: 14519
Change-Id: Ie3519067d609afb1bbf9e67f7f15f95911d2b173
Reviewed-on: https://code.wireshark.org/review/26388
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
| -rw-r--r-- | epan/dissectors/packet-wsp.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/epan/dissectors/packet-wsp.c b/epan/dissectors/packet-wsp.c index ec77d44794..c5ad4aa7a0 100644 --- a/epan/dissectors/packet-wsp.c +++ b/epan/dissectors/packet-wsp.c @@ -1282,7 +1282,7 @@ static void add_headers (proto_tree *tree, tvbuff_t *tvb, int hf, packet_info *p #define get_uintvar_integer(val,tvb,start,len,ok) \ val = tvb_get_guintvar(tvb,start,&len, pinfo, &ei_wsp_oversized_uintvar); \ - if (len>5) ok = FALSE; else ok = TRUE; + if (len>5 || len==0) ok = FALSE; else ok = TRUE; #define get_short_integer(val,tvb,start,len,ok) \ val = tvb_get_guint8(tvb,start); \ if (val & 0x80) ok = TRUE; else ok=FALSE; \ @@ -5183,6 +5183,8 @@ add_capabilities (proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, guint8 pd * Get the length of the capability field */ capaValueLen = tvb_get_guintvar(tvb, offset, &len, pinfo, &ei_wsp_oversized_uintvar); + if (len == 0) + return; capaLen = capaValueLen + len; cap_subtree = proto_tree_add_subtree(wsp_capabilities, tvb, offset, capaLen, ett_capabilities_entry, &cap_item, "Capability"); |