diff options
| author | Pascal Quantin <pascal.quantin@gmail.com> | 2018-08-08 16:45:21 +0200 |
|---|---|---|
| committer | Pascal Quantin <pascal.quantin@gmail.com> | 2018-08-08 20:22:14 +0000 |
| commit | 739eebd3d2e39db63c959eb99291edf59647ed6d (patch) | |
| tree | c27a89b95a1869a9752b8d015911a56ea8628234 /epan/dissectors/packet-ieee80211-radiotap-iter.c | |
| parent | f4bc40bc3ba3828b1dd700608aa28b75d78e30ad (diff) | |
802.11 Radiotap: add more bound checks in ieee80211_radiotap_iterator_next()
Bug: 15022
Change-Id: Ife413312c88b8d78926c78bdb6707903257e7964
Reviewed-on: https://code.wireshark.org/review/29017
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
Diffstat (limited to 'epan/dissectors/packet-ieee80211-radiotap-iter.c')
| -rw-r--r-- | epan/dissectors/packet-ieee80211-radiotap-iter.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/epan/dissectors/packet-ieee80211-radiotap-iter.c b/epan/dissectors/packet-ieee80211-radiotap-iter.c index 167cb39899..e10fdaf2d7 100644 --- a/epan/dissectors/packet-ieee80211-radiotap-iter.c +++ b/epan/dissectors/packet-ieee80211-radiotap-iter.c @@ -132,6 +132,7 @@ int ieee80211_radiotap_iterator_init( iterator->_bitmap_shifter = get_unaligned_le32(&radiotap_header->it_present); iterator->_arg = (guint8 *)radiotap_header + sizeof(*radiotap_header); iterator->_reset_on_ext = 0; + iterator->_next_ns_data = NULL; iterator->_next_bitmap = &radiotap_header->it_present; iterator->_next_bitmap++; iterator->_vns = vns; @@ -288,9 +289,14 @@ int ieee80211_radiotap_iterator_next( } if (!align) { /* skip all subsequent data */ + if (!iterator->_next_ns_data) + return -EINVAL; iterator->_arg = iterator->_next_ns_data; /* give up on this namespace */ iterator->current_namespace = NULL; + iterator->_next_ns_data = NULL; + if (!ITERATOR_VALID(iterator, 0)) + return -EINVAL; goto next_entry; } break; |