Add another buffer length check to group key decryption.

svn path=/trunk/; revision=26071

1 files changed, 6 insertions, 0 deletions

diff --git a/epan/crypt/airpdcap.c b/epan/crypt/airpdcap.c
index 0ea6b6ce12..241ab4c9d7 100644
--- a/epan/crypt/airpdcap.c
+++ b/epan/crypt/airpdcap.c
@@ -459,6 +459,7 @@ AirPDcapGetSaPtr(
 	return &ctx->sa[sa_index];
 }
 
+#define GROUP_KEY_PAYLOAD_LEN (8+4+sizeof(EAPOL_RSN_KEY))
 INT AirPDcapScanForGroupKey(
     PAIRPDCAP_CONTEXT ctx,
     const guint8 *data,
@@ -487,6 +488,11 @@ INT AirPDcapScanForGroupKey(
 
 	AIRPDCAP_DEBUG_TRACE_START("AirPDcapScanForGroupKey");
 
+        if (mac_header_len + GROUP_KEY_PAYLOAD_LEN < tot_len) {
+            AIRPDCAP_DEBUG_PRINT_LINE("AirPDcapScanForGroupKey", "Message too short", AIRPDCAP_DEBUG_LEVEL_3);
+            return AIRPDCAP_RET_NO_VALID_HANDSHAKE;
+        }
+
 	/* cache offset in the packet data */
 	offset = mac_header_len;