diff options
author | Stig Bjørlykke <stig@bjorlykke.org> | 2011-06-30 09:31:11 +0000 |
---|---|---|
committer | Stig Bjørlykke <stig@bjorlykke.org> | 2011-06-30 09:31:11 +0000 |
commit | c026f4b01c7175d7ce1231dac278818f2f764fec (patch) | |
tree | f6f620f3a0d6b07db03d3c53f9b4c3f35dac8686 /epan/dissectors/packet-rpcap.c | |
parent | 9fb3af3bf10e543eade4e519c6f963e953f45e38 (diff) |
Avoid absurdly large values used in for-loops.
svn path=/trunk/; revision=37842
Diffstat (limited to 'epan/dissectors/packet-rpcap.c')
-rw-r--r-- | epan/dissectors/packet-rpcap.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/epan/dissectors/packet-rpcap.c b/epan/dissectors/packet-rpcap.c index 0596e0a574..aafd074647 100644 --- a/epan/dissectors/packet-rpcap.c +++ b/epan/dissectors/packet-rpcap.c @@ -428,6 +428,11 @@ dissect_rpcap_findalldevs_if (tvbuff_t *tvb, packet_info *pinfo _U_, for (i = 0; i < naddr; i++) { offset = dissect_rpcap_findalldevs_ifaddr (tvb, pinfo, tree, offset); + if (tvb_length_remaining (tvb, offset) <= 0) { + /* No more data in packet */ + expert_add_info_format (pinfo, ti, PI_MALFORMED, PI_ERROR, "No more data in packet"); + break; + } } proto_item_set_len (ti, offset - boffset); @@ -449,6 +454,11 @@ dissect_rpcap_findalldevs_reply (tvbuff_t *tvb, packet_info *pinfo _U_, for (i = 0; i < no_devs; i++) { offset = dissect_rpcap_findalldevs_if (tvb, pinfo, tree, offset); + if (tvb_length_remaining (tvb, offset) <= 0) { + /* No more data in packet */ + expert_add_info_format (pinfo, ti, PI_MALFORMED, PI_ERROR, "No more data in packet"); + break; + } } proto_item_append_text (ti, ", %d item%s", no_devs, plurality (no_devs, "", "s")); @@ -504,6 +514,11 @@ dissect_rpcap_filter (tvbuff_t *tvb, packet_info *pinfo, for (i = 0; i < nitems; i++) { offset = dissect_rpcap_filterbpf_insn (tvb, pinfo, tree, offset); + if (tvb_length_remaining (tvb, offset) <= 0) { + /* No more data in packet */ + expert_add_info_format (pinfo, ti, PI_MALFORMED, PI_ERROR, "No more data in packet"); + break; + } } } |