diff options
| author | Gerald Combs <gerald@wireshark.org> | 2020-08-31 10:44:39 -0700 |
|---|---|---|
| committer | Gerald Combs <gerald@wireshark.org> | 2020-09-02 21:19:32 +0000 |
| commit | 10204490d7c06bb9222240cb036857e8dcac5d2d (patch) | |
| tree | c2efd0fe4282728e53b13101995635b6f0e80c28 /epan/dissectors/packet-usb-hid.c | |
| parent | 0e6027313d0fb24024f194c7231407d556f3efd1 (diff) | |
USB HID: Avoid allocating a huge amount of memory.
Make sure we don't pass a huge number to wmem_array_grow. Closes #16809.
Diffstat (limited to 'epan/dissectors/packet-usb-hid.c')
| -rw-r--r-- | epan/dissectors/packet-usb-hid.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/epan/dissectors/packet-usb-hid.c b/epan/dissectors/packet-usb-hid.c index 0a703117f8..021efbbb81 100644 --- a/epan/dissectors/packet-usb-hid.c +++ b/epan/dissectors/packet-usb-hid.c @@ -3443,6 +3443,9 @@ parse_report_descriptor(report_descriptor_t *rdesc) return FALSE; usage_max = hid_unpack_value(data, i, size); + if (usage_min >= usage_max) { + goto err; + } wmem_array_grow(field.usages, usage_max - usage_min); for (guint32 j = usage_min; j < usage_max; j++) |