diff options
| author | easonweii <sharkhw@huawei.com> | 2022-04-26 10:50:05 +0800 |
|---|---|---|
| committer | A Wireshark GitLab Utility <gerald+gitlab-utility@wireshark.org> | 2022-04-26 19:27:15 +0000 |
| commit | b72b4cf51297e1e07aaaa1cf92112e882cc9fe70 (patch) | |
| tree | fdf0f716781f50fe3a915b06c555c8c25440be7e /epan/dissectors/packet-lldp.c | |
| parent | 90cc7cadf784d4c76a5a5840aec3059c14239da7 (diff) | |
LLDP: Fix malformed packets when EndOfLLDPDU TLV missing
The End of LLDPDU TLV is optional, should not as malformed even if missing.
Resolve it by checking whether the total length of each TLV reaches the total length of TVB.
Close #18029
Diffstat (limited to 'epan/dissectors/packet-lldp.c')
| -rw-r--r-- | epan/dissectors/packet-lldp.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/epan/dissectors/packet-lldp.c b/epan/dissectors/packet-lldp.c index c0cc04ee95..b3e4867062 100644 --- a/epan/dissectors/packet-lldp.c +++ b/epan/dissectors/packet-lldp.c @@ -1795,7 +1795,7 @@ dissect_lldp_time_to_live(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, g return offset; } -/* Dissect End of LLDPDU TLV (Mandatory) */ +/* Dissect End of LLDPDU TLV */ static gint32 dissect_lldp_end_of_lldpdu(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, guint32 offset) { @@ -4624,7 +4624,7 @@ dissect_lldp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_ gint32 rtnValue = 0; guint16 tempShort; guint8 tlvType; - gboolean reachedEnd = FALSE; + guint32 tvbLen; profinet_lldp_column_info *pn_lldp_column_info = NULL; col_set_str(pinfo->cinfo, COL_PROTOCOL, "LLDP"); @@ -4676,9 +4676,9 @@ dissect_lldp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_ offset += rtnValue; - - /* Dissect optional tlv's until end-of-lldpdu is reached */ - while (!reachedEnd) + tvbLen = tvb_captured_length(tvb); + /* Dissect optional tlv info that contained in data packets */ + while (offset < tvbLen) { tempShort = tvb_get_ntohs(tvb, offset); tlvType = TLV_TYPE(tempShort); @@ -4735,8 +4735,8 @@ dissect_lldp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_ } if (rtnValue < 0) { - reachedEnd = TRUE; set_actual_length(tvb, offset + rtnValue); + break; } else offset += rtnValue; |