From d85db24ce58b624bdd5c4cef3d06fcfba5a3ec25 Mon Sep 17 00:00:00 2001 From: Darien Spencer Date: Mon, 19 Jun 2017 12:16:47 -0700 Subject: FP: Fix out of bounds error in heuristic PCH dissector Heuristic PCH dissector was trying to access the packet's header (4 bytes) without asserting these bytes exist Change-Id: Id2747e00ed353b1962293b3cd3ea6fbe9449a81d Reviewed-on: https://code.wireshark.org/review/22220 Reviewed-by: Pascal Quantin --- epan/dissectors/packet-umts_fp.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/epan/dissectors/packet-umts_fp.c b/epan/dissectors/packet-umts_fp.c index 1e070994e1..645ca0a358 100644 --- a/epan/dissectors/packet-umts_fp.c +++ b/epan/dissectors/packet-umts_fp.c @@ -4453,6 +4453,11 @@ heur_dissect_fp_pch(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *d pi_length_found = FALSE; } + /* Making sure we have at least enough bytes for header (4) + footer (2) */ + if (length < 6) { + return FALSE; + } + p_fp_info = (fp_info *)p_get_proto_data(wmem_file_scope(), pinfo, proto_fp, 0); /* Making sure FP info isn't already attached */ if (p_fp_info) { -- cgit v1.2.1