diff options
| author | Michael Mann <mmann78@netscape.net> | 2018-02-17 22:20:29 -0500 |
|---|---|---|
| committer | Michael Mann <mmann78@netscape.net> | 2018-02-18 14:21:16 +0000 |
| commit | b6328eba6a3d33930489709ee1e47140dcc30dfb (patch) | |
| tree | 83066a68fe958a9912cf7a245ea218168023f822 | |
| parent | 95affa1ef1484741156a34aface45aa5e16c02c9 (diff) | |
DICOM: Prevent infinite loop (dissect_dcm_tag)
uint32 value could wrap around, resulting in infinite loop.
Bug: 14411
Change-Id: I26c73f74adc65c7a5acf22970a54c93a7f7a2344
Reviewed-on: https://code.wireshark.org/review/25873
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot
Reviewed-by: Michael Mann <mmann78@netscape.net>
| -rw-r--r-- | epan/dissectors/packet-dcm.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/epan/dissectors/packet-dcm.c b/epan/dissectors/packet-dcm.c index c57d54e697..707b32bcd1 100644 --- a/epan/dissectors/packet-dcm.c +++ b/epan/dissectors/packet-dcm.c @@ -6284,7 +6284,8 @@ dissect_dcm_tag(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, ett, &tag_pitem, tag_summary); vl_max = 0; /* We don't know who long this sequence/item is */ } - else if (offset + vl <= endpos) { + else if ((offset + vl <= endpos) && + (offset + vl > offset)) { /* Ensure no wraparound */ /* Show real length of item */ tag_ptree = proto_tree_add_subtree(tree, tvb, offset_tag, offset + vl - offset_tag, ett, &tag_pitem, tag_summary); |