fix for bug 1054

there were instances where the function dissect_nt_sid() would not fill in the return pointer for the sid string
causing callers that rely on that this string will ALWAYS be assigned try to access and g_free() an uninitialized pointer.

dissect_nt_sid() should be changed to use and return ep allocated memory instead of gmalloced memory




git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@19154 f5534014-38df-0310-8fa8-9805f1628bb7

1 files changed, 11 insertions, 0 deletions

diff --git a/epan/dissectors/packet-windows-common.c b/epan/dissectors/packet-windows-common.c
index 57cba568be..3ad85383d8 100644
--- a/epan/dissectors/packet-windows-common.c
+++ b/epan/dissectors/packet-windows-common.c
@@ -1,3 +1,6 @@
+/* TODO: dissect_nt_sid() should be changed to return ep memory
+ * and not gmalloc memory.
+ */
 /* packet-windows-common.c
  * Routines for dissecting various Windows data types
  *
@@ -1281,6 +1284,11 @@ dissect_nt_sid(tvbuff_t *tvb, int offset, proto_tree *parent_tree,
 	size_t returned_length;
 	unsigned long str_index;;
 
+
+	if(sid_str){
+		*sid_str=NULL;
+	}
+
 	sid_string=ep_alloc(MAX_STR_LEN);
 	if(hf_sid==-1){
 		hf_sid=hf_nt_sid;
@@ -1384,6 +1392,9 @@ dissect_nt_sid(tvbuff_t *tvb, int offset, proto_tree *parent_tree,
           }
 	}
 
+	if(sid_str && !(*sid_str)){
+		*sid_str=g_strdup("corrupted sid");
+	}
 
 	return offset;
 }