aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPeter Wu <peter@lekensteyn.nl>2016-02-20 15:27:40 +0100
committerPeter Wu <peter@lekensteyn.nl>2016-02-20 14:38:48 +0000
commitc31425f9ae15067e26ccc6183c206c34713cb256 (patch)
tree44ede016035def87ea910ef24ae2bf81fd4b79c3
parent071dfd761dd2d63cff2b55c505b7d1d95d06e22c (diff)
gsm_abis_oml: fix buffer overrun
Do not read outside boundaries when tag is exactly 0xff. tag = tvb_get_guint8(tvb, offset); tdef = find_tlv_tag(tag); ... return &nm_att_tlvdef_base.def[tag]; Bug: 11825 Change-Id: I42e624185abb2166aa0f8d0dbd71a2a86fc0b18e Reviewed-on: https://code.wireshark.org/review/14030 Reviewed-by: Peter Wu <peter@lekensteyn.nl>
-rw-r--r--epan/dissectors/packet-gsm_abis_oml.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/epan/dissectors/packet-gsm_abis_oml.c b/epan/dissectors/packet-gsm_abis_oml.c
index a6158c3611..543b0341eb 100644
--- a/epan/dissectors/packet-gsm_abis_oml.c
+++ b/epan/dissectors/packet-gsm_abis_oml.c
@@ -618,7 +618,7 @@ struct tlv_def {
};
struct tlv_definition {
- struct tlv_def def[0xff];
+ struct tlv_def def[0x100];
};
enum abis_nm_ipacc_test_no {