diff options
| author | Michael Mann <mmann78@netscape.net> | 2016-05-09 20:41:45 -0400 |
|---|---|---|
| committer | Peter Wu <peter@lekensteyn.nl> | 2016-05-10 15:20:49 +0000 |
| commit | b6d838eebf4456192360654092e5587c5207f185 (patch) | |
| tree | 77a834153b8f6dee37acf8a934651baa911a8ef5 /epan | |
| parent | 2bc2b3e686df39bb655c54b101b11537507fb5a3 (diff) | |
| download | wireshark-b6d838eebf4456192360654092e5587c5207f185.tar.gz | |
Sanity check eapol_len in AirPDcapDecryptWPABroadcastKey
Bug: 12175
Change-Id: Iaf977ba48f8668bf8095800a115ff9a3472dd893
Reviewed-on: https://code.wireshark.org/review/15326
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Tested-by: Peter Wu <peter@lekensteyn.nl>
Diffstat (limited to 'epan')
| -rw-r--r-- | epan/crypt/airpdcap.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/epan/crypt/airpdcap.c b/epan/crypt/airpdcap.c index bb4d7bc43d..dd948a0d1d 100644 --- a/epan/crypt/airpdcap.c +++ b/epan/crypt/airpdcap.c @@ -351,7 +351,9 @@ AirPDcapDecryptWPABroadcastKey(const EAPOL_RSN_KEY *pEAPKey, guint8 *decryption_ } } - if (key_bytes_len < GROUP_KEY_MIN_LEN || key_bytes_len > eapol_len - sizeof(EAPOL_RSN_KEY)) { + if ((key_bytes_len < GROUP_KEY_MIN_LEN) || + (eapol_len < sizeof(EAPOL_RSN_KEY)) || + (key_bytes_len > eapol_len - sizeof(EAPOL_RSN_KEY))) { return AIRPDCAP_RET_NO_VALID_HANDSHAKE; } |