diff options
| author | Pascal Quantin <pascal.quantin@gmail.com> | 2017-06-19 21:23:47 +0200 |
|---|---|---|
| committer | Pascal Quantin <pascal.quantin@gmail.com> | 2017-06-20 00:54:48 +0000 |
| commit | c3c2e844248120c7d4e33f389f53f649281f09b9 (patch) | |
| tree | 58a9cd4bf97b18a75b8cd020f4be195d3b65cfcf /epan | |
| parent | d9cbe24a702b7bd802b6ac2c7bd668eaa78e990a (diff) | |
| download | wireshark-c3c2e844248120c7d4e33f389f53f649281f09b9.tar.gz | |
AMQP: fix a stack overflow when offset goes back and forth
Previous code assumed that list decoding was successful and that some
bytes were consumed. Let's explicitly check this.
Bug: 13780
Change-Id: I3546b093f309f2b8096f01bc9987ac5ad9e029eb
Reviewed-on: https://code.wireshark.org/review/22235
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
(cherry picked from commit 246cbbc2ea6dd0a3a69a1aaa94db244a77565353)
Reviewed-on: https://code.wireshark.org/review/22248
Diffstat (limited to 'epan')
| -rw-r--r-- | epan/dissectors/packet-amqp.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/epan/dissectors/packet-amqp.c b/epan/dissectors/packet-amqp.c index 44899370a6..303bd3bbd2 100644 --- a/epan/dissectors/packet-amqp.c +++ b/epan/dissectors/packet-amqp.c @@ -9978,7 +9978,13 @@ get_amqp_1_0_value_formatter(tvbuff_t *tvb, item, hf_amqp_type, hf_amqp_subtype_count, - hf_amqp_subtypes, name)-1; /* "-1" due to decode type again in the method */ + hf_amqp_subtypes, name); + if (*length_size == 0) { + /* something went wrong during list dissection; let's stop here */ + *length_size = tvb_reported_length_remaining(tvb, offset); + } else { + *length_size -= 1; /* "-1" due to decode type again in the method */ + } break; case AMQP_1_0_TYPE_MAP8: case AMQP_1_0_TYPE_MAP32: |