diff options
| author | Evan Huus <eapache@gmail.com> | 2013-09-25 16:57:21 +0000 |
|---|---|---|
| committer | Evan Huus <eapache@gmail.com> | 2013-09-25 16:57:21 +0000 |
| commit | eb64e871ba3716d7e29799a1fd73dac607dd8f50 (patch) | |
| tree | c545b5cbcef3d4848c80f88be51a35faab8fd138 /epan/dissectors/packet-dtp.c | |
| parent | 95bc2da1e8814ba0d36ef9d77a8ec45871518530 (diff) | |
Prevent offset overflow in DTP dissector. Fixes
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9184
Also add modelines.
svn path=/trunk/; revision=52214
Diffstat (limited to 'epan/dissectors/packet-dtp.c')
| -rw-r--r-- | epan/dissectors/packet-dtp.c | 19 |
1 files changed, 17 insertions, 2 deletions
diff --git a/epan/dissectors/packet-dtp.c b/epan/dissectors/packet-dtp.c index 87bc8f34b0..b515250590 100644 --- a/epan/dissectors/packet-dtp.c +++ b/epan/dissectors/packet-dtp.c @@ -175,7 +175,7 @@ dissect_dtp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) while (tvb_reported_length_remaining(tvb, offset) > 0) { int type, length, valuelength; proto_item * tlv_length_item; - + if (tvb_length_remaining(tvb, offset) < 4) { expert_add_info(pinfo, dtp_tree, &ei_dtp_truncated); break; @@ -206,7 +206,9 @@ dissect_dtp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) else expert_add_info(pinfo, tlv_length_item, &ei_dtp_tlv_length_invalid); - offset += valuelength; + if (offset + valuelength > offset) { + offset += valuelength; + } } } @@ -368,3 +370,16 @@ proto_reg_handoff_dtp(void) dtp_handle = create_dissector_handle(dissect_dtp, proto_dtp); dissector_add_uint("llc.cisco_pid", 0x2004, dtp_handle); } + +/* + * Editor modelines - http://www.wireshark.org/tools/modelines.html + * + * Local variables: + * c-basic-offset: 8 + * tab-width: 8 + * indent-tabs-mode: t + * End: + * + * vi: set shiftwidth=8 tabstop=8 noexpandtab: + * :indentSize=8:tabSize=8:noTabs=false: + */ |