diff options
| author | Stig Bjørlykke <stig@bjorlykke.org> | 2011-07-28 22:19:46 +0000 |
|---|---|---|
| committer | Stig Bjørlykke <stig@bjorlykke.org> | 2011-07-28 22:19:46 +0000 |
| commit | 10c3eaa3213f58d8b34e759023ad9fd3e3e8a1e9 (patch) | |
| tree | ff3fa04a70dc46d280afc9a87a2eaaa03201fe4e /epan/dissectors/packet-isakmp.c | |
| parent | d6253e7504e49a15762bde14512dc6d6ddd854e6 (diff) | |
Avoid a possible infinite loop in dissect_delete().
This may fix the "Malformed IKE Packet DoS" bug.
svn path=/trunk/; revision=38247
Diffstat (limited to 'epan/dissectors/packet-isakmp.c')
| -rw-r--r-- | epan/dissectors/packet-isakmp.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/epan/dissectors/packet-isakmp.c b/epan/dissectors/packet-isakmp.c index 6f85ca0d79..61e3c27c80 100644 --- a/epan/dissectors/packet-isakmp.c +++ b/epan/dissectors/packet-isakmp.c @@ -3880,12 +3880,13 @@ dissect_delete(tvbuff_t *tvb, int offset, int length, proto_tree *tree, int isak offset += 2; length -= 2; - - while (length > 0) { + if (spi_size > 0) { + while (length > 0) { proto_tree_add_item(tree, hf_isakmp_delete_spi, tvb, offset, spi_size, FALSE); offset+=spi_size; length-=spi_size; - } + } + } } |