From 9a81d2ec3764f33a2525c66d784e24f00a852916 Mon Sep 17 00:00:00 2001 From: erikdejong Date: Sun, 19 Mar 2017 19:19:11 +0100 Subject: Fix: UA3G read past end of tvb + NOE key descriptions packet-ua3g.c: Start tone device routing packet causes exception because it adds a subtree with length 6 where it should be 3. Changed 6 to 3. packet-noe.c: Key description is incomplete because buffer reserved is only 10 bytes long and key descriptions are up to 23 bytes long. Changed buffer length to 24. Bug: 13502 Change-Id: I8212d23c650efd341e87f766a80a887ef82f4b0b Reviewed-on: https://code.wireshark.org/review/20633 Petri-Dish: Alexis La Goutte Tested-by: Petri Dish Buildbot Reviewed-by: Michael Mann --- epan/dissectors/packet-noe.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'epan/dissectors/packet-noe.c') diff --git a/epan/dissectors/packet-noe.c b/epan/dissectors/packet-noe.c index b3bfb25f34..09d338d720 100644 --- a/epan/dissectors/packet-noe.c +++ b/epan/dissectors/packet-noe.c @@ -856,7 +856,7 @@ static char *decode_key_name(int unicode) { char *key_name; - key_name = (char *)wmem_alloc(wmem_packet_scope(), 10); + key_name = (char *)wmem_alloc(wmem_packet_scope(), 24); if ((unicode <= 0x20) || (unicode == 0x7F) @@ -866,15 +866,15 @@ static char *decode_key_name(int unicode) || (unicode == 0xE9) || (unicode == 0xF9)) { - g_snprintf(key_name, 10, "%s", val_to_str_ext_const(unicode, &str_key_name_ext, "Unknown")); + g_snprintf(key_name, 24, "%s", val_to_str_ext_const(unicode, &str_key_name_ext, "Unknown")); } else if (unicode <= 0xFF) { - g_snprintf(key_name, 10, "%c", unicode); + g_snprintf(key_name, 24, "%c", unicode); } else { - g_snprintf(key_name, 10, "%s", val_to_str_ext_const(unicode, &str_key_name_ext, "Unknown")); + g_snprintf(key_name, 24, "%s", val_to_str_ext_const(unicode, &str_key_name_ext, "Unknown")); } return key_name; } -- cgit v1.2.3