diff options
| author | Bill Meier <wmeier@newsguy.com> | 2009-03-31 21:47:58 +0000 |
|---|---|---|
| committer | Bill Meier <wmeier@newsguy.com> | 2009-03-31 21:47:58 +0000 |
| commit | b45c3cb272ddb420fa075e5a697b93fedaedc7ee (patch) | |
| tree | bf867879fe295fb03b6158023b03793e5b8868ad /epan/dissectors/packet-sdp.c | |
| parent | 7afd67fd94eecf507ae4a75654df1b6306436736 (diff) | |
| download | wireshark-b45c3cb272ddb420fa075e5a697b93fedaedc7ee.tar.gz | |
Change to prevent "off-the-end" array access if invalid payload-type/media-format;
Prevents crash as reported in bug 3373:
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3373)
svn path=/trunk/; revision=27917
Diffstat (limited to 'epan/dissectors/packet-sdp.c')
| -rw-r--r-- | epan/dissectors/packet-sdp.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/epan/dissectors/packet-sdp.c b/epan/dissectors/packet-sdp.c index 8e13027d03..cb40cad84b 100644 --- a/epan/dissectors/packet-sdp.c +++ b/epan/dissectors/packet-sdp.c @@ -1532,6 +1532,9 @@ static void dissect_sdp_media_attribute(tvbuff_t *tvb, packet_info *pinfo, proto key=g_malloc( sizeof(gint) ); *key=atol((char*)payload_type); pt = atoi((char*)payload_type); + if (pt >= SDP_NO_OF_PT) { + return; /* Invalid */ + } transport_info->encoding_name[pt] = (char*)tvb_get_ephemeral_string(tvb, offset, tokenlen); @@ -1601,6 +1604,9 @@ static void dissect_sdp_media_attribute(tvbuff_t *tvb, packet_info *pinfo, proto hf_media_format, tvb, offset, tokenlen, FALSE); media_format = atoi((char*)tvb_get_ephemeral_string(tvb, offset, tokenlen)); + if (media_format >= SDP_NO_OF_PT) { + return; /* Invalid */ + } /* Append encoding name to format if known */ proto_item_append_text(media_format_item, " [%s]", |