diff options
| author | Michael Mann <mmann78@netscape.net> | 2018-02-17 13:40:55 -0500 |
|---|---|---|
| committer | Michael Mann <mmann78@netscape.net> | 2018-02-18 14:20:09 +0000 |
| commit | 95affa1ef1484741156a34aface45aa5e16c02c9 (patch) | |
| tree | a9154f38511d24271c166b895b6cb49fdfd33e7f /epan/dissectors/packet-usb.c | |
| parent | bee04353b91cbec90c9377f74ceeefa374757c65 (diff) | |
USB: Sanity check Darwin USB header to prevent infinite loop.
Bug: 14421
Change-Id: Ifb492b776182507c10664d067f99312af250e6ff
Reviewed-on: https://code.wireshark.org/review/25872
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot
Reviewed-by: Michael Mann <mmann78@netscape.net>
Diffstat (limited to 'epan/dissectors/packet-usb.c')
| -rw-r--r-- | epan/dissectors/packet-usb.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/epan/dissectors/packet-usb.c b/epan/dissectors/packet-usb.c index e075b5ff56..d7f53b7a10 100644 --- a/epan/dissectors/packet-usb.c +++ b/epan/dissectors/packet-usb.c @@ -4253,7 +4253,7 @@ dissect_darwin_usb_iso_transfer(packet_info *pinfo _U_, proto_tree *tree, usb_he frame_header_length = tvb_get_guint32(tvb, offset, ENC_LITTLE_ENDIAN); frame_length = tvb_get_guint32(tvb, offset + 4, ENC_LITTLE_ENDIAN); - if (len < frame_header_length) { + if ((len < frame_header_length) || (frame_header_length < 20)) { break; } |