diff options
| author | Dario Lombardo <lomato@gmail.com> | 2022-01-13 10:14:54 +0100 |
|---|---|---|
| committer | A Wireshark GitLab Utility <gerald+gitlab-utility@wireshark.org> | 2022-01-13 14:53:13 +0000 |
| commit | 445b3f7eaa0690715f040c08fbb942ba1f57ca0c (patch) | |
| tree | 772ba0d2e6b3a6c111da99eb4193e219b30826f2 | |
| parent | c427b81aa28e412220c36a0bde118a1be34ff975 (diff) | |
openflow_v6: add one more sanity check.
Ref: #17847.
| -rw-r--r-- | epan/dissectors/packet-openflow_v6.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/epan/dissectors/packet-openflow_v6.c b/epan/dissectors/packet-openflow_v6.c index f381e46a7c..abff32a7c4 100644 --- a/epan/dissectors/packet-openflow_v6.c +++ b/epan/dissectors/packet-openflow_v6.c @@ -5555,6 +5555,11 @@ dissect_openflow_queue_desc_prop_v6(tvbuff_t *tvb, packet_info *pinfo _U_, proto break; case OFPQDPT_EXPERIMENTER: + if (prop_len <= 16) { + expert_add_info(pinfo, ti, &ei_openflow_v6_length_too_short); + offset = length; + break; + } /* uint32_t experimenter; */ proto_tree_add_item(prop_tree, hf_openflow_v6_queue_desc_prop_experimenter_experimenter, tvb, offset, 4, ENC_BIG_ENDIAN); offset+=4; @@ -5570,6 +5575,11 @@ dissect_openflow_queue_desc_prop_v6(tvbuff_t *tvb, packet_info *pinfo _U_, proto break; default: + if (prop_len <= 8) { + expert_add_info(pinfo, ti, &ei_openflow_v6_length_too_short); + offset = length; + break; + } proto_tree_add_expert_format(prop_tree, pinfo, &ei_openflow_v6_queue_desc_prop_undecoded, tvb, offset, prop_len - 8, "Unknown queue property body."); offset+=prop_len-8; |