IPv6: do not allocate tap data on stack

Bug: 10780
Change-Id: I2526fb9a5a2dfd61b19dff5ba1b7902f77927f4a
Reviewed-on: https://code.wireshark.org/review/6276
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Pascal Quantin <pascal.quantin@gmail.com>

1 files changed, 11 insertions, 11 deletions

diff --git a/epan/dissectors/packet-ipv6.c b/epan/dissectors/packet-ipv6.c
index ac239c739f..d682bb6e41 100644
--- a/epan/dissectors/packet-ipv6.c
+++ b/epan/dissectors/packet-ipv6.c
@@ -1853,17 +1853,17 @@ dissect_ipv6(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
        in the ip.proto dissector table may need it */
     ws_ip iph;
 
-    struct ip6_hdr ipv6;
+    struct ip6_hdr *ipv6;
 
     col_set_str(pinfo->cinfo, COL_PROTOCOL, "IPv6");
     col_clear(pinfo->cinfo, COL_INFO);
 
     offset = 0;
     memset(&iph, 0, sizeof(iph));
-    tvb_memcpy(tvb, (guint8 *)&ipv6, offset, sizeof(ipv6));
+    ipv6 = (struct ip6_hdr*)tvb_memdup(wmem_packet_scope(), tvb, offset, sizeof(struct ip6_hdr));
 
     /* Get extension header and payload length */
-    plen = g_ntohs(ipv6.ip6_plen);
+    plen = g_ntohs(ipv6->ip6_plen);
 
     /* Adjust the length of this tvbuff to include only the IPv6 datagram. */
     set_actual_length(tvb, plen + (guint)sizeof (struct ip6_hdr));
@@ -1906,9 +1906,9 @@ dissect_ipv6(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 
         proto_tree_add_uint_format_value(ipv6_tree, hf_ipv6_nxt, tvb,
                                          offset + (int)offsetof(struct ip6_hdr, ip6_nxt), 1,
-                                         ipv6.ip6_nxt,
+                                         ipv6->ip6_nxt,
                                          "%s (%u)",
-                                         ipprotostr(ipv6.ip6_nxt), ipv6.ip6_nxt);
+                                         ipprotostr(ipv6->ip6_nxt), ipv6->ip6_nxt);
     }
 
     /* Needed for Decode As */
@@ -1923,11 +1923,11 @@ dissect_ipv6(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
                             offset + (int)offsetof(struct ip6_hdr, ip6_src), 16, ENC_NA);
         ti = proto_tree_add_ipv6(ipv6_tree, hf_ipv6_addr, tvb,
                                  offset + (int)offsetof(struct ip6_hdr, ip6_src),
-                                 16, (guint8 *)&ipv6.ip6_src);
+                                 16, (guint8 *)&ipv6->ip6_src);
         PROTO_ITEM_SET_HIDDEN(ti);
         name = ep_address_to_display(&pinfo->src);
         if (ipv6_summary_in_tree) {
-            SET_ADDRESS(&addr, AT_IPv6, 16, ipv6.ip6_src.bytes);
+            SET_ADDRESS(&addr, AT_IPv6, 16, ipv6->ip6_src.bytes);
             proto_item_append_text(ipv6_item, ", Src: %s (%s)", name, address_to_str(wmem_packet_scope(), &addr));
         }
         ti = proto_tree_add_string(ipv6_tree, hf_ipv6_src_host, tvb,
@@ -2011,11 +2011,11 @@ dissect_ipv6(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
                             offset + (int)offsetof(struct ip6_hdr, ip6_dst), 16, ENC_NA);
         ti = proto_tree_add_ipv6(ipv6_tree, hf_ipv6_addr, tvb,
                                  offset + (int)offsetof(struct ip6_hdr, ip6_dst),
-                                 16, (guint8 *)&ipv6.ip6_dst);
+                                 16, (guint8 *)&ipv6->ip6_dst);
         PROTO_ITEM_SET_HIDDEN(ti);
         name = ep_address_to_display(&pinfo->dst);
         if (ipv6_summary_in_tree) {
-            SET_ADDRESS(&addr, AT_IPv6, 16, ipv6.ip6_dst.bytes);
+            SET_ADDRESS(&addr, AT_IPv6, 16, ipv6->ip6_dst.bytes);
             proto_item_append_text(ipv6_item, ", Dst: %s (%s)", name, address_to_str(wmem_packet_scope(), &addr));
         }
         ti = proto_tree_add_string(ipv6_tree, hf_ipv6_dst_host, tvb,
@@ -2097,7 +2097,7 @@ dissect_ipv6(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 
 #ifdef HAVE_GEOIP_V6
     if (tree && ipv6_use_geoip) {
-        add_geoip_info(ipv6_tree, tvb, offset, &ipv6.ip6_src, &ipv6.ip6_dst);
+        add_geoip_info(ipv6_tree, tvb, offset, &ipv6->ip6_src, &ipv6->ip6_dst);
     }
 #endif
     /* Fill in IPv4 fields for potential subdissectors */
@@ -2178,7 +2178,7 @@ again:
 
     /* collect packet info */
     p_add_proto_data(pinfo->pool, pinfo, proto_ipv6, IPV6_PROTO_VALUE, GUINT_TO_POINTER((guint)nxt));
-    tap_queue_packet(ipv6_tap, pinfo, &ipv6);
+    tap_queue_packet(ipv6_tap, pinfo, ipv6);
 
     if (offlg & IP6F_OFF_MASK || (ipv6_reassemble && offlg & IP6F_MORE_FRAG)) {
         /* Not the first fragment, or the first when we are reassembling and there are more. */