diff options
| author | Peter Wu <peter@lekensteyn.nl> | 2016-01-09 15:27:14 +0100 |
|---|---|---|
| committer | Anders Broman <a.broman58@gmail.com> | 2016-01-12 08:25:38 +0000 |
| commit | a5a2c3c04f131d13a296d3ddc902986ba37a4d0c (patch) | |
| tree | 177dfbdc2bf341ee2de0a02c771edd3a8cc40df2 /epan | |
| parent | f83e20202f2530b5ca51969bdc5c7cf23d69e498 (diff) | |
| download | wireshark-a5a2c3c04f131d13a296d3ddc902986ba37a4d0c.tar.gz | |
Fix infinite loop for when port max range is -1
Due to integer overflow (unsigned -1 + 1 = 0), a call to
dissector_add_uint_range would be stuck in an infinite loop, eventually
crashing due to out of memory.
Found when setting radius.alternate_port:-1, but could happen with any
dissector using similar ports_range constructs.
Change-Id: Ia234e94516446250e959e0f51d552bef704cddff
Reviewed-on: https://code.wireshark.org/review/13153
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Diffstat (limited to 'epan')
| -rw-r--r-- | epan/packet.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/epan/packet.c b/epan/packet.c index 808d532c29..d204f03544 100644 --- a/epan/packet.c +++ b/epan/packet.c @@ -952,8 +952,9 @@ void dissector_add_uint_range(const char *abbrev, range_t *range, if (range) { for (i = 0; i < range->nranges; i++) { - for (j = range->ranges[i].low; j <= range->ranges[i].high; j++) + for (j = range->ranges[i].low; j < range->ranges[i].high; j++) dissector_add_uint(abbrev, j, handle); + dissector_add_uint(abbrev, range->ranges[i].high, handle); } } } @@ -997,8 +998,9 @@ void dissector_delete_uint_range(const char *abbrev, range_t *range, if (range) { for (i = 0; i < range->nranges; i++) { - for (j = range->ranges[i].low; j <= range->ranges[i].high; j++) + for (j = range->ranges[i].low; j < range->ranges[i].high; j++) dissector_delete_uint(abbrev, j, handle); + dissector_delete_uint(abbrev, range->ranges[i].high, handle); } } } |