diff options
| author | Michael Mann <mmann78@netscape.net> | 2017-06-14 12:52:09 -0400 |
|---|---|---|
| committer | Anders Broman <a.broman58@gmail.com> | 2017-06-15 04:16:18 +0000 |
| commit | 552dab08a6ea1b47465d888c613c353f8697e918 (patch) | |
| tree | 093a3f16f418c0eb78b21974662960d5f6aee83b /epan/dissectors/packet-btrfcomm.c | |
| parent | acb488b7f4c628ec0aecdb970694c6f5a97974bc (diff) | |
packet-btrfcomm.c: Prevent over bit shift in get_le_multi_byte_value.
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2163
Bug: 13783
Change-Id: I92cefec86f9545345d00cf28e32ef7c05064417c
Reviewed-on: https://code.wireshark.org/review/22141
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Diffstat (limited to 'epan/dissectors/packet-btrfcomm.c')
| -rw-r--r-- | epan/dissectors/packet-btrfcomm.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/epan/dissectors/packet-btrfcomm.c b/epan/dissectors/packet-btrfcomm.c index 091cf9e932..3c2336f86c 100644 --- a/epan/dissectors/packet-btrfcomm.c +++ b/epan/dissectors/packet-btrfcomm.c @@ -312,7 +312,7 @@ get_le_multi_byte_value(tvbuff_t *tvb, int offset, proto_tree *tree, guint32 *va byte = tvb_get_guint8(tvb, offset); offset += 1; val |= ((byte >> 1) & 0xff) << (bc++ * 7); - } while ((byte & 0x1) == 0); + } while (((byte & 0x1) == 0) && (bc <= 4)); *val_ptr = val; |