diff options
author | Guy Harris <guy@alum.mit.edu> | 2011-12-13 01:05:52 +0000 |
---|---|---|
committer | Guy Harris <guy@alum.mit.edu> | 2011-12-13 01:05:52 +0000 |
commit | 73a808f9bceca4fdc6039b56d0038bf89a5934b8 (patch) | |
tree | 31e1769dc5a68526ed0a8bf57f583f9830b8584d /wiretap/i4btrace.c | |
parent | b669a11931e84076a113010c294d5eb3fce116d3 (diff) |
Add missing check for a too-large packet, so we don't blow up trying to
allocate a huge buffer; fixes bug 6667.
svn path=/trunk/; revision=40166
Diffstat (limited to 'wiretap/i4btrace.c')
-rw-r--r-- | wiretap/i4btrace.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/wiretap/i4btrace.c b/wiretap/i4btrace.c index e4155b5e6b..ac2336ce40 100644 --- a/wiretap/i4btrace.c +++ b/wiretap/i4btrace.c @@ -145,6 +145,16 @@ static gboolean i4btrace_read(wtap *wth, int *err, gchar **err_info, return FALSE; } length = hdr.length - (guint32)sizeof(hdr); + if (length > WTAP_MAX_PACKET_SIZE) { + /* + * Probably a corrupt capture file; don't blow up trying + * to allocate space for an immensely-large packet. + */ + *err = WTAP_ERR_BAD_RECORD; + *err_info = g_strdup_printf("i4btrace: File has %u-byte packet, bigger than maximum of %u", + length, WTAP_MAX_PACKET_SIZE); + return FALSE; + } wth->phdr.len = length; wth->phdr.caplen = length; |