diff options
| author | Michael Mann <mmann78@netscape.net> | 2017-06-14 12:52:09 -0400 |
|---|---|---|
| committer | Michael Mann <mmann78@netscape.net> | 2017-06-15 11:33:26 +0000 |
| commit | d802138333a2fc4a838b10deeaa6c0551b3b66b1 (patch) | |
| tree | 57ba2d16fee5743764d3b0f003902ee21f398ba6 | |
| parent | 7f8d5f9ce16760e68220b8961cf308725dccd96a (diff) | |
| download | wireshark-d802138333a2fc4a838b10deeaa6c0551b3b66b1.tar.gz | |
packet-btrfcomm.c: Prevent over bit shift in get_le_multi_byte_value.
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2163
Bug: 13783
Change-Id: I92cefec86f9545345d00cf28e32ef7c05064417c
Reviewed-on: https://code.wireshark.org/review/22141
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
(cherry picked from commit 552dab08a6ea1b47465d888c613c353f8697e918)
Reviewed-on: https://code.wireshark.org/review/22152
Reviewed-by: Michael Mann <mmann78@netscape.net>
| -rw-r--r-- | epan/dissectors/packet-btrfcomm.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/epan/dissectors/packet-btrfcomm.c b/epan/dissectors/packet-btrfcomm.c index 091cf9e932..3c2336f86c 100644 --- a/epan/dissectors/packet-btrfcomm.c +++ b/epan/dissectors/packet-btrfcomm.c @@ -312,7 +312,7 @@ get_le_multi_byte_value(tvbuff_t *tvb, int offset, proto_tree *tree, guint32 *va byte = tvb_get_guint8(tvb, offset); offset += 1; val |= ((byte >> 1) & 0xff) << (bc++ * 7); - } while ((byte & 0x1) == 0); + } while (((byte & 0x1) == 0) && (bc <= 4)); *val_ptr = val; |