diff options
| author | Gerald Combs <gerald@wireshark.org> | 2022-02-05 10:25:25 -0800 |
|---|---|---|
| committer | A Wireshark GitLab Utility <gerald+gitlab-utility@wireshark.org> | 2022-02-07 20:06:41 +0000 |
| commit | 2a4171fc06645ba70c9b657528679e111db0791b (patch) | |
| tree | 313e49af3243c69974572cb9d06a913c1d9bd3e0 | |
| parent | 6b3daa9aec7d549bf583e22727c67885cdb9321b (diff) | |
| download | wireshark-2a4171fc06645ba70c9b657528679e111db0791b.tar.gz wireshark-2a4171fc06645ba70c9b657528679e111db0791b.tar.bz2 wireshark-2a4171fc06645ba70c9b657528679e111db0791b.zip | |
WAP: Clamp our value lengths to a usable value.
tvb_get_guintvar returns a length which is often used for arithmetic.
Clamp it to a value which is less likely to overflow. Fixes #17925.
| -rw-r--r-- | epan/dissectors/packet-wap.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/epan/dissectors/packet-wap.c b/epan/dissectors/packet-wap.c index 832c38918a..1384f02be0 100644 --- a/epan/dissectors/packet-wap.c +++ b/epan/dissectors/packet-wap.c @@ -28,7 +28,11 @@ * value continues into the next byte. * The octetCount parameter holds the number of bytes read in order to return * the final value. Can be pre-initialised to start at offset+count. -*/ + * + * XXX This seems to be used exclusively for fetching size values. We should + * probably rename this to wap_get_checked_size or something along those lines. + */ +#define MAX_WAP_GUINTVAR (100 * 1000 * 1000) // Arbitrary. We need a large number that won't overflow a guint. guint tvb_get_guintvar (tvbuff_t *tvb, guint offset, guint *octetCount, packet_info *pinfo, expert_field *ei) @@ -50,10 +54,11 @@ tvb_get_guintvar (tvbuff_t *tvb, guint offset, previous_value = value; value <<= 7; /* Value only exists in 7 of the 8 bits */ value += (octet & 0x7F); - if (value < previous_value) { + if (value < previous_value || value > MAX_WAP_GUINTVAR) { /* overflow; clamp the value at UINT_MAX */ proto_tree_add_expert(NULL, pinfo, ei, tvb, offset, counter); - value = UINT_MAX; + value = MAX_WAP_GUINTVAR; + break; } #ifdef DEBUG |