diff options
| author | Pascal Quantin <pascal.quantin@gmail.com> | 2015-11-25 17:53:30 +0100 |
|---|---|---|
| committer | Michael Mann <mmann78@netscape.net> | 2015-11-25 23:59:58 +0000 |
| commit | 2259bf8a827088081bef101f98e4983de8aa8099 (patch) | |
| tree | c14db177df29a98c8af60dc3e074a2176e4d1b3d /epan/dissectors/packet-sctp.c | |
| parent | 723756bfd7a368feb6f60409fbc0992f7efd4827 (diff) | |
SCTP: verify frame pointer before dereferencing it
Bug: 11767
Change-Id: Icd01550e0aaa4cd0cc33ae3acc0ef702c38f4db4
Reviewed-on: https://code.wireshark.org/review/12146
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Diffstat (limited to 'epan/dissectors/packet-sctp.c')
| -rw-r--r-- | epan/dissectors/packet-sctp.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/epan/dissectors/packet-sctp.c b/epan/dissectors/packet-sctp.c index e8c19b22d4..5a81574ee2 100644 --- a/epan/dissectors/packet-sctp.c +++ b/epan/dissectors/packet-sctp.c @@ -3440,12 +3440,14 @@ dissect_data_chunk(tvbuff_t *chunk_tvb, cur = wmem_list_tail(pinfo->layers); retval = dissect_payload(payload_tvb, pinfo, tree, payload_proto_id); cur = wmem_list_frame_next(cur); - tmp = wmem_list_frame_data(cur); - proto_id = GPOINTER_TO_UINT(tmp); - proto_name = proto_get_protocol_filter_name(proto_id); - if (strcmp(proto_name, "data") != 0){ - if (have_tap_listener(exported_pdu_tap)){ - export_sctp_data_chunk(pinfo,payload_tvb, proto_name); + if (cur) { + tmp = wmem_list_frame_data(cur); + proto_id = GPOINTER_TO_UINT(tmp); + proto_name = proto_get_protocol_filter_name(proto_id); + if (strcmp(proto_name, "data") != 0){ + if (have_tap_listener(exported_pdu_tap)){ + export_sctp_data_chunk(pinfo,payload_tvb, proto_name); + } } } } |