diff options
| author | Jeff Morriss <jeff.morriss@ulticom.com> | 2010-10-20 01:49:32 +0000 |
|---|---|---|
| committer | Jeff Morriss <jeff.morriss@ulticom.com> | 2010-10-20 01:49:32 +0000 |
| commit | dfa6aa82a75c8b9f47296be0fb099b3a95a8544b (patch) | |
| tree | 00c28889e9fe828182b62a0fda95e22d96127200 /epan/dissectors/packet-ldss.c | |
| parent | df0692a8e6246ffe790f5ee23c1e5b060c8a24f6 (diff) | |
| download | wireshark-dfa6aa82a75c8b9f47296be0fb099b3a95a8544b.tar.gz | |
Fix SE memory corruption reported in https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5318 :
Ensure the digest is smaller than our buffer before copying it.
svn path=/trunk/; revision=34581
Diffstat (limited to 'epan/dissectors/packet-ldss.c')
| -rw-r--r-- | epan/dissectors/packet-ldss.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/epan/dissectors/packet-ldss.c b/epan/dissectors/packet-ldss.c index 8d9d601a6e..1b7ab8bede 100644 --- a/epan/dissectors/packet-ldss.c +++ b/epan/dissectors/packet-ldss.c @@ -606,6 +606,8 @@ dissect_ldss_transfer (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) tvb_get_ptr(tvb, offset+digest_type_len, linelen-digest_type_len), digest_bytes, FALSE); + if(digest_bytes->len >= DIGEST_LEN) + digest_bytes->len = (DIGEST_LEN-1); /* Ensure the digest is zero-padded */ transfer_info->file->digest = se_alloc0(DIGEST_LEN); memcpy(transfer_info->file->digest, digest_bytes->data, digest_bytes->len); |