diff options
| author | Evan Huus <eapache@gmail.com> | 2013-09-25 16:41:09 +0000 |
|---|---|---|
| committer | Evan Huus <eapache@gmail.com> | 2013-09-25 16:41:09 +0000 |
| commit | 95bc2da1e8814ba0d36ef9d77a8ec45871518530 (patch) | |
| tree | 0b92b78fee006e971c7584c349367bb5e485073c /epan/dissectors/packet-ntlmssp.c | |
| parent | 31f9c281ad2913e80ccad235cc359cafbb27391c (diff) | |
Require the NTLMSSP response contents to be long enough before we try to memcpy
it. Fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9182
svn path=/trunk/; revision=52213
Diffstat (limited to 'epan/dissectors/packet-ntlmssp.c')
| -rw-r--r-- | epan/dissectors/packet-ntlmssp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/epan/dissectors/packet-ntlmssp.c b/epan/dissectors/packet-ntlmssp.c index dbe0ace8bd..b832264392 100644 --- a/epan/dissectors/packet-ntlmssp.c +++ b/epan/dissectors/packet-ntlmssp.c @@ -1817,7 +1817,7 @@ dissect_ntlmssp_auth (tvbuff_t *tvb, packet_info *pinfo, int offset, } else { - if (conv_ntlmssp_info->lm_response.contents == NULL) { + if (conv_ntlmssp_info->lm_response.contents == NULL || conv_ntlmssp_info->lm_response.length < 8) { memset(conv_ntlmssp_info->client_challenge, 0, 8); } else { memcpy(conv_ntlmssp_info->client_challenge, conv_ntlmssp_info->lm_response.contents, 8); |