diff options
| author | Evan Huus <eapache@gmail.com> | 2013-10-10 17:44:55 +0000 |
|---|---|---|
| committer | Evan Huus <eapache@gmail.com> | 2013-10-10 17:44:55 +0000 |
| commit | f29544f9df11fec5ab0f051a58c775365d6e368a (patch) | |
| tree | dc4fb4d2f7a05dc50c7daebda9ffc72b2974d422 /asn1 | |
| parent | 7a1a387d510c176f22fdbf177a9b0d011b3afd67 (diff) | |
| download | wireshark-f29544f9df11fec5ab0f051a58c775365d6e368a.tar.gz | |
Add a call to tvb_ensure_bytes_exist before we allocate memory based on our
offset+size, prevents attempts to allocate outrageous memory, fixing
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9260
svn path=/trunk/; revision=52503
Diffstat (limited to 'asn1')
| -rw-r--r-- | asn1/c1222/packet-c1222-template.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/asn1/c1222/packet-c1222-template.c b/asn1/c1222/packet-c1222-template.c index a467d899d3..1f221056f1 100644 --- a/asn1/c1222/packet-c1222-template.c +++ b/asn1/c1222/packet-c1222-template.c @@ -315,6 +315,7 @@ static uat_t *c1222_uat; length = offset - start_offset; \ switch (tvb_get_guint8(tvb, start_offset)) { \ case 0x80: /* relative OID */ \ + tvb_ensure_bytes_exist(tvb, start_offset, length); \ fieldname##_len = length + c1222_baseoid_len; \ fieldname = (guint8 *)wmem_alloc(wmem_packet_scope(), fieldname##_len); \ fieldname[0] = 0x06; /* create absolute OID tag */ \ @@ -327,11 +328,11 @@ static uat_t *c1222_uat; fieldname = (guint8 *)tvb_memdup(wmem_packet_scope(), tvb, start_offset, length); \ fieldname##_len = length; \ break; \ - } + } #else /* HAVE_LIBGCRYPT */ #define FILL_TABLE(fieldname) #define FILL_TABLE_TRUNCATE(fieldname, len) -#define FILL_TABLE_APTITLE(fieldname) +#define FILL_TABLE_APTITLE(fieldname) #define FILL_START #endif /* HAVE_LIBGCRYPT */ |