diff options
| author | Darien Spencer <cusneud@mail.com> | 2017-06-19 12:16:47 -0700 |
|---|---|---|
| committer | Pascal Quantin <pascal.quantin@gmail.com> | 2017-06-19 13:44:40 +0000 |
| commit | d85db24ce58b624bdd5c4cef3d06fcfba5a3ec25 (patch) | |
| tree | bdf179e12f29080744de857c257c552a162fbfc6 /epan | |
| parent | 31ffb58eb0db57df45f1f8e45afb759251982793 (diff) | |
| download | wireshark-d85db24ce58b624bdd5c4cef3d06fcfba5a3ec25.tar.gz | |
FP: Fix out of bounds error in heuristic PCH dissector
Heuristic PCH dissector was trying to access the packet's header (4 bytes) without asserting these bytes exist
Change-Id: Id2747e00ed353b1962293b3cd3ea6fbe9449a81d
Reviewed-on: https://code.wireshark.org/review/22220
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Diffstat (limited to 'epan')
| -rw-r--r-- | epan/dissectors/packet-umts_fp.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/epan/dissectors/packet-umts_fp.c b/epan/dissectors/packet-umts_fp.c index 1e070994e1..645ca0a358 100644 --- a/epan/dissectors/packet-umts_fp.c +++ b/epan/dissectors/packet-umts_fp.c @@ -4453,6 +4453,11 @@ heur_dissect_fp_pch(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *d pi_length_found = FALSE; } + /* Making sure we have at least enough bytes for header (4) + footer (2) */ + if (length < 6) { + return FALSE; + } + p_fp_info = (fp_info *)p_get_proto_data(wmem_file_scope(), pinfo, proto_fp, 0); /* Making sure FP info isn't already attached */ if (p_fp_info) { |