diff options
| author | Pascal Quantin <pascal.quantin@gmail.com> | 2018-03-09 09:48:37 +0100 |
|---|---|---|
| committer | Anders Broman <a.broman58@gmail.com> | 2018-03-09 09:49:46 +0000 |
| commit | 572f78a8610282151e7d165b11e0bf5092efbb5a (patch) | |
| tree | e58a3045d007fe4bf3e237f8dfd73a85ccd48c70 /epan | |
| parent | 4495d8fbfdc680b37671f8139664463e84b7e0bf (diff) | |
LACP: protect a possible infinite loop
Offset should not go backwards.
Bug: 14518
Change-Id: I03a64ae9a99f1ca095f0bc710f93f0f6ba2248e6
Reviewed-on: https://code.wireshark.org/review/26384
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Diffstat (limited to 'epan')
| -rw-r--r-- | epan/dissectors/packet-lacp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/epan/dissectors/packet-lacp.c b/epan/dissectors/packet-lacp.c index b597f4a8a9..44a3305e92 100644 --- a/epan/dissectors/packet-lacp.c +++ b/epan/dissectors/packet-lacp.c @@ -316,7 +316,7 @@ dissect_lacp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_ tlv_length_item = proto_tree_add_item_ret_uint(lacp_tree, hf_lacp_tlv_length, tvb, offset, 1, ENC_BIG_ENDIAN, &tlv_length); offset += 1; - while (tlv_type != LACPDU_TYPE_TERMINATOR) { + while (tlv_type != LACPDU_TYPE_TERMINATOR && tlv_length >= 2) { offset += (tlv_length - 2); proto_tree_add_item_ret_uint(lacp_tree, hf_lacp_tlv_type, tvb, offset, 1, ENC_BIG_ENDIAN, &tlv_type); offset += 1; |