diff options
| author | John Thacker <johnthacker@gmail.com> | 2022-12-01 20:46:15 -0500 |
|---|---|---|
| committer | John Thacker <johnthacker@gmail.com> | 2022-12-01 21:18:12 -0500 |
| commit | 13823bb1059cf70f401892ba1b1eaa2400cdf3db (patch) | |
| tree | bce006c68784440d990715bc4e5e7dfb885c2ea4 | |
| parent | 0e119321837e6ec69fe6cb04aee04935e0386d7a (diff) | |
openflow_v6: Prevent infinite loops in too short ofp_stats
The ofp_stats struct length field includes the fixed 4 bytes.
If the length is smaller than that, report the length error
and break out. In particular, a value of zero can cause
infinite loops if this isn't done.
| -rw-r--r-- | epan/dissectors/packet-openflow_v6.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/epan/dissectors/packet-openflow_v6.c b/epan/dissectors/packet-openflow_v6.c index aab8829fbc..ae016a33eb 100644 --- a/epan/dissectors/packet-openflow_v6.c +++ b/epan/dissectors/packet-openflow_v6.c @@ -1119,17 +1119,23 @@ dissect_openflow_v6_oxs(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, static int dissect_openflow_stats_v6(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, guint16 length _U_) { + proto_item *ti; guint32 stats_length; int oxs_end; guint32 padding; proto_tree_add_item(tree, hf_openflow_v6_stats_reserved, tvb, offset, 2, ENC_NA); - proto_tree_add_item_ret_uint(tree, hf_openflow_v6_stats_length, tvb, offset+2, 2, ENC_BIG_ENDIAN, &stats_length); + ti = proto_tree_add_item_ret_uint(tree, hf_openflow_v6_stats_length, tvb, offset+2, 2, ENC_BIG_ENDIAN, &stats_length); oxs_end = offset + stats_length; offset+=4; + if (stats_length < 4) { + expert_add_info(pinfo, ti, &ei_openflow_v6_length_too_short); + return offset; + } + while (offset < oxs_end) { offset = dissect_openflow_v6_oxs(tvb, pinfo, tree, offset, oxs_end - offset); } |