diff options
| author | Pascal Quantin <pascal.quantin@gmail.com> | 2017-11-17 23:09:09 +0100 |
|---|---|---|
| committer | Michael Mann <mmann78@netscape.net> | 2017-11-18 00:42:25 +0000 |
| commit | ed68e05014018672ba6675c8b970b4471fbb68c5 (patch) | |
| tree | ea31e963963c0c5195b65c7a4b9fa22283be2dfc /epan | |
| parent | 658578a5b935d12c86b4181f9949da54a4ba7e0f (diff) | |
IEEE 802.11: fix an infinite loop
Presumably the element length is unsigned, otherwise it can be negative
and reincrement tag length.
Bug: 14231
Change-Id: I26d339aea7588a489b4252b67c212810029bff0e
Reviewed-on: https://code.wireshark.org/review/24472
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Michael Mann <mmann78@netscape.net>
Diffstat (limited to 'epan')
| -rw-r--r-- | epan/dissectors/packet-ieee80211.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/epan/dissectors/packet-ieee80211.c b/epan/dissectors/packet-ieee80211.c index e64f69ebe0..00898fc869 100644 --- a/epan/dissectors/packet-ieee80211.c +++ b/epan/dissectors/packet-ieee80211.c @@ -13146,7 +13146,7 @@ dissect_measurement_pilot_trans_ie(tvbuff_t *tvb, packet_info *pinfo _U_, proto_ if (tag_len > 0) { while (tag_len > 0) { - gint8 elt_len = 0; + guint8 elt_len; elt_len = tvb_get_guint8(tvb, offset + 1); |