diff options
Diffstat (limited to 'epan')
| -rw-r--r-- | epan/dissectors/packet-ieee80211.c | 38 |
1 files changed, 37 insertions, 1 deletions
diff --git a/epan/dissectors/packet-ieee80211.c b/epan/dissectors/packet-ieee80211.c index 682e42409f..2ba775ad05 100644 --- a/epan/dissectors/packet-ieee80211.c +++ b/epan/dissectors/packet-ieee80211.c @@ -20444,7 +20444,7 @@ dissect_he_capabilities(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, /* Get and isolate the phy channel witdth set */ phy_channel_width_set = tvb_get_guint8(tvb, offset) >> 1; - phy_cap_tree = proto_tree_add_subtree(tree, tvb, offset, 9, ett_he_phy_capabilities, + phy_cap_tree = proto_tree_add_subtree(tree, tvb, offset, 11, ett_he_phy_capabilities, NULL, "HE Phy Capabilities Information"); proto_tree_add_bitmask_with_flags(phy_cap_tree, tvb, offset, @@ -20475,6 +20475,13 @@ dissect_he_capabilities(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, he_phy_b72_to_b87_headers, ENC_LITTLE_ENDIAN, BMT_NO_APPEND); offset += 2; + if (tvb_reported_length_remaining(tvb, offset) < 2) { + expert_add_info_format(pinfo, phy_cap_tree, &ei_ieee80211_tag_length, + "Insufficient bytes for Phy Capabilities " + "Rx and Tx Maps 80MHz!"); + return; + } + /* Need the length first */ if (phy_channel_width_set & HE_CHANNEL_WIDTH_SET_B2) he_mcs_and_nss_len += 4; @@ -20493,6 +20500,14 @@ dissect_he_capabilities(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, ett_he_rx_mcs_map_lte_80, he_mcs_map_80_rx_headers, ENC_LITTLE_ENDIAN, BMT_NO_APPEND); offset += 2; + + if (tvb_reported_length_remaining(tvb, offset) < 2) { + expert_add_info_format(pinfo, phy_cap_tree, &ei_ieee80211_tag_length, + "Insufficient bytes for Phy Capabilities " + "Tx Maps 80MHz!"); + return; + } + proto_tree_add_bitmask_with_flags(rx_tx_he_mcs_map_80, tvb, offset, hf_he_tx_he_mcs_map_lte_80, ett_he_tx_mcs_map_lte_80, he_mcs_map_80_tx_headers, @@ -20500,6 +20515,12 @@ dissect_he_capabilities(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, offset += 2; if (phy_channel_width_set & HE_CHANNEL_WIDTH_SET_B2) { + if (tvb_reported_length_remaining(tvb, offset) < 2) { + expert_add_info_format(pinfo, phy_cap_tree, &ei_ieee80211_tag_length, + "Insufficient bytes for Phy Capabilities " + "Rx and Tx MCS Maps 160MHz!"); + return; + } rx_tx_he_mcs_map_160 = proto_tree_add_subtree(sup_he_mcs_and_nss_tree, tvb, offset, 4, ett_he_rx_tx_he_mcs_map_160, NULL, "Rx and Tx MCS Maps 160 MHz"); @@ -20508,6 +20529,14 @@ dissect_he_capabilities(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, ett_he_rx_mcs_map_160, he_mcs_map_160_rx_headers, ENC_LITTLE_ENDIAN, BMT_NO_APPEND); offset += 2; + + if (tvb_reported_length_remaining(tvb, offset) < 2) { + expert_add_info_format(pinfo, phy_cap_tree, &ei_ieee80211_tag_length, + "Insufficient bytes for Phy Capabilities " + "Tx MCS Maps 160MHz!"); + return; + } + proto_tree_add_bitmask_with_flags(rx_tx_he_mcs_map_160, tvb, offset, hf_he_tx_he_mcs_map_160, ett_he_tx_mcs_map_160, he_mcs_map_160_tx_headers, @@ -20516,6 +20545,13 @@ dissect_he_capabilities(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, } if (phy_channel_width_set & HE_CHANNEL_WIDTH_SET_B3) { + if (tvb_reported_length_remaining(tvb, offset) < 2) { + expert_add_info_format(pinfo, phy_cap_tree, &ei_ieee80211_tag_length, + "Insufficient bytes for Phy Capabilities " + "Rx and Tx MCS Maps 80+80 MHz!"); + return; + } + rx_tx_he_mcs_map_80_80 = proto_tree_add_subtree(sup_he_mcs_and_nss_tree, tvb, offset, 4, ett_he_rx_tx_he_mcs_map_80_80, NULL, "Rx and Tx MCS Maps 80+80 MHz"); |