diff options
| author | Evan Huus <eapache@gmail.com> | 2015-06-08 10:07:43 -0400 |
|---|---|---|
| committer | Evan Huus <eapache@gmail.com> | 2015-06-08 18:32:30 +0000 |
| commit | 0f36b1c3942331e3509bc66e0e3d5876b5bfe9d4 (patch) | |
| tree | 227023ad593d235a4feae9a580d34bb82305e6b0 /epan/dissectors/packet-aeron.c | |
| parent | b30d7b1f779b45527429a1302845fe8c03c9bbad (diff) | |
aeron: fix infinite loop
`dissected_length` can come from the packet in some paths, meaning it can be 0
or negative and we need to check for underflows and other such problems
Bug: 11255
Change-Id: Iba55ec1824a391ec1c717bfea5b65cc6610fc081
Reviewed-on: https://code.wireshark.org/review/8839
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Evan Huus <eapache@gmail.com>
Diffstat (limited to 'epan/dissectors/packet-aeron.c')
| -rw-r--r-- | epan/dissectors/packet-aeron.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/epan/dissectors/packet-aeron.c b/epan/dissectors/packet-aeron.c index 23f00abbe5..0652d1bb74 100644 --- a/epan/dissectors/packet-aeron.c +++ b/epan/dissectors/packet-aeron.c @@ -2710,6 +2710,9 @@ static int dissect_aeron(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, default: return (total_dissected_length); } + if (length_remaining - dissected_length >= length_remaining) { + return (total_dissected_length); + } total_dissected_length += dissected_length; offset += dissected_length; length_remaining -= dissected_length; |