diff options
author | etxrab <etxrab@f5534014-38df-0310-8fa8-9805f1628bb7> | 2011-09-16 05:16:18 +0000 |
---|---|---|
committer | etxrab <etxrab@f5534014-38df-0310-8fa8-9805f1628bb7> | 2011-09-16 05:16:18 +0000 |
commit | c5aab71b6c1ed7e59e88621e9f9ba61bcb37753a (patch) | |
tree | 3e7c29abde046889b2d5e472ae4d722247a704a4 /epan/dissectors/packet-cms.c | |
parent | 1b1205d2e683ced75360200107c4e650e0a3be47 (diff) |
From Jouni Malinen:
If the GAS Query Request/Response Length field is incorrect, the
dissector function may return a value that is larger than the remaining
packet buffer. This results in a Tagged parameters item being added with
-1 byte length since tvb_reported_length_remaining() reports -1 once the
offset goes beyond the end of the packet. Clicking on that item results
in Wireshark dying on Gtk-ERROR. Note: this does not show up in tshark
and as such, cannot apparently be triggered with fuzz-test.sh.
Fix this by refusing to dissect GAS frames that have too large length
field value. In addition, verify that tvb_reported_length_remaining() is
returning a value larger than 0 instead of non-zero (which could be -1)
to make the IEEE 802.11 dissector more robust against this type of
issues.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6345
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@39024 f5534014-38df-0310-8fa8-9805f1628bb7
Diffstat (limited to 'epan/dissectors/packet-cms.c')
0 files changed, 0 insertions, 0 deletions