diff options
| author | Sergio Moreno Mozota <sergio.morenomozota@telefonica.com> | 2015-01-17 23:24:22 -0500 |
|---|---|---|
| committer | Michael Mann <mmann78@netscape.net> | 2015-01-19 02:57:13 +0000 |
| commit | 199cb062e114f0f27b378467a785f90452bfd5f5 (patch) | |
| tree | c3b5d7b1b4cd103db651577ffb5120a9442fee39 /epan/dissectors/packet-rtp.c | |
| parent | e333e4c90f0aca41b0a56cef22fd80d0b0e73e14 (diff) | |
RTP: Parse problem in dissect_rtp_hext_rfc5215_onebyte
some commercial IPTV streamers send bogus info in the extension headers, add some sanity check to skip the erroneous bytes.
Bug: 10513
Change-Id: I6f20073a00ed0f791fa99701534360d304060053
Reviewed-on: https://code.wireshark.org/review/6606
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Diffstat (limited to 'epan/dissectors/packet-rtp.c')
| -rw-r--r-- | epan/dissectors/packet-rtp.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/epan/dissectors/packet-rtp.c b/epan/dissectors/packet-rtp.c index 29cb9c3937..d44101bc76 100644 --- a/epan/dissectors/packet-rtp.c +++ b/epan/dissectors/packet-rtp.c @@ -1833,6 +1833,12 @@ dissect_rtp_hext_rfc5215_onebyte( tvbuff_t *tvb, packet_info *pinfo, return; ext_length = (ext_hdr_hdr & 0x0F) + 1; + + /* Exit on malformed extension headers */ + if (ext_offset + ext_length + 1 > tvb_captured_length (tvb)) { + return; + } + if (rtp_hext_tree) { rtp_hext_rfc5285_tree = proto_tree_add_subtree(rtp_hext_tree, tvb, ext_offset, ext_length + 1, ett_hdr_ext_rfc5285, NULL, "RFC 5285 Header Extension (One-Byte Header)"); |