diff options
| author | Martin Kaiser <wireshark@kaiser.cx> | 2020-07-12 14:19:31 +0200 |
|---|---|---|
| committer | Anders Broman <a.broman58@gmail.com> | 2020-07-13 05:12:09 +0000 |
| commit | 32a804dea2b6d657b581f5e5e14585099c53ddbe (patch) | |
| tree | da7a67703801bcde00ed79170760ff011d5512d2 /epan/dissectors/packet-kafka.c | |
| parent | a71ecfa2b533e5bf7290282091c15f7c7d7b6226 (diff) | |
kafka: snappy: free the composite tvb only once
The snappy decompression routine has the same bug that was fixed for lz4 in
79576219c9 ("kafka: lz4: free the composite tvb only once").
Refactor the composite tvb handling for snappy as well. Allocate the
composite tvb only if we are cetain that data will be added to it.
Do not free the composite tvb ourselves, leave this to epan cleanup.
Change-Id: Ide3a88d1c02e525fe1aadd176068ce68c2330b98
Reviewed-on: https://code.wireshark.org/review/37838
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Petri-Dish: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Diffstat (limited to 'epan/dissectors/packet-kafka.c')
| -rw-r--r-- | epan/dissectors/packet-kafka.c | 19 |
1 files changed, 10 insertions, 9 deletions
diff --git a/epan/dissectors/packet-kafka.c b/epan/dissectors/packet-kafka.c index 7048e4308f..dc43b9f172 100644 --- a/epan/dissectors/packet-kafka.c +++ b/epan/dissectors/packet-kafka.c @@ -1416,8 +1416,6 @@ decompress_snappy(tvbuff_t *tvb, packet_info *pinfo, int offset, guint32 length, /* xerial framing format */ guint32 chunk_size, pos = 16; - composite_tvb = tvb_new_composite(); - while (pos < length) { if (pos > length-4) { // XXX - this is presumably an error, as the chunk size @@ -1448,16 +1446,15 @@ decompress_snappy(tvbuff_t *tvb, packet_info *pinfo, int offset, guint32 length, if (rc != SNAPPY_OK) { goto end; } + + if (!composite_tvb) { + composite_tvb = tvb_new_composite(); + } tvb_composite_append(composite_tvb, tvb_new_child_real_data(tvb, decompressed_buffer, (guint)uncompressed_size, (gint)uncompressed_size)); pos += chunk_size; } - tvb_composite_finalize(composite_tvb); - *decompressed_tvb = composite_tvb; - *decompressed_offset = 0; - composite_tvb = NULL; - } else { /* unframed format */ @@ -1479,8 +1476,12 @@ decompress_snappy(tvbuff_t *tvb, packet_info *pinfo, int offset, guint32 length, } ret = 1; end: - if (composite_tvb != NULL) { - tvb_free_chain(composite_tvb); + if (composite_tvb) { + tvb_composite_finalize(composite_tvb); + if (ret == 1) { + *decompressed_tvb = composite_tvb; + *decompressed_offset = 0; + } } if (ret == 0) { col_append_str(pinfo->cinfo, COL_INFO, " [snappy decompression failed]"); |