diff options
| author | Pascal Quantin <pascal.quantin@gmail.com> | 2016-08-16 23:52:03 +0200 |
|---|---|---|
| committer | Anders Broman <a.broman58@gmail.com> | 2016-08-17 07:05:04 +0000 |
| commit | 2e37b271c473e1cbd01d62ebe1f3b011fc9fe638 (patch) | |
| tree | f635e34dc7682168b6771ae75eace8317d7249ee | |
| parent | 3b97fbddc23c065727b0147aab52a27c4aadffe7 (diff) | |
DCT2000: fix a buffer overflow in case of malformed packet
Bug: 12750
Change-Id: Iff20efa46e000ab4ae77b2edbcb0b9af4634508c
Reviewed-on: https://code.wireshark.org/review/17096
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
| -rw-r--r-- | epan/dissectors/packet-catapult-dct2000.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/epan/dissectors/packet-catapult-dct2000.c b/epan/dissectors/packet-catapult-dct2000.c index fc9f8835a1..743019b9e8 100644 --- a/epan/dissectors/packet-catapult-dct2000.c +++ b/epan/dissectors/packet-catapult-dct2000.c @@ -1578,6 +1578,9 @@ static void attach_fp_info(packet_info *pinfo, gboolean received, const char *pr /* Number of channels (for coordinated channels) */ p_fp_info->num_chans = outhdr_values[i++]; + if (p_fp_info->num_chans > MAX_FP_CHANS) { + p_fp_info->num_chans = MAX_FP_CHANS; + } /* EDCH-Common is always T2 */ if (p_fp_info->channel == CHANNEL_EDCH_COMMON) { |