diff options
| author | Gilbert Ramirez <gram@alumni.rice.edu> | 1999-12-02 23:25:29 +0000 |
|---|---|---|
| committer | Gilbert Ramirez <gram@alumni.rice.edu> | 1999-12-02 23:25:29 +0000 |
| commit | 0537fdd8b6f7cbb6d28bc3a1274ef1d4df403187 (patch) | |
| tree | 3c21db0bd4429587ff93b92f296b2a5344d9e133 /packet-radius.c | |
| parent | 024948f3a6aae732886d13ce1a02d357e9081cdb (diff) | |
| download | wireshark-0537fdd8b6f7cbb6d28bc3a1274ef1d4df403187.tar.gz wireshark-0537fdd8b6f7cbb6d28bc3a1274ef1d4df403187.tar.bz2 wireshark-0537fdd8b6f7cbb6d28bc3a1274ef1d4df403187.zip | |
Fix infinite loop on short packets or bad data in radius dissector.
Problem reported by Arni Raghu <arni@caip.rutgers.edu>.
svn path=/trunk/; revision=1185
Diffstat (limited to 'packet-radius.c')
| -rw-r--r-- | packet-radius.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/packet-radius.c b/packet-radius.c index 2aaa1ebae9..e0ce3ae05f 100644 --- a/packet-radius.c +++ b/packet-radius.c @@ -1,7 +1,7 @@ /* packet-radius.c * Routines for RADIUS packet disassembly * - * $Id: packet-radius.c,v 1.5 1999/11/16 11:42:49 guy Exp $ + * $Id: packet-radius.c,v 1.6 1999/12/02 23:25:29 gram Exp $ * * Ethereal - Network traffic analyzer * By Johan Feyaerts @@ -529,10 +529,16 @@ void dissect_attribute_value_pairs(const u_char *pd, int offset, frame_data avptpstrval=match_strval(avph.avp_type, radius_attrib_type_vals); if (avptpstrval == NULL) avptpstrval="Unknown Type"; valstr=rd_value_to_str(&avph, pd, offset); + if (!BYTES_ARE_IN_FRAME(offset, avph.avp_length)) { + break; + } proto_tree_add_text(tree,offset,avph.avp_length, "t:%s(%d) l:%d, value:%s", avptpstrval,avph.avp_type,avph.avp_length,valstr); offset=offset+avph.avp_length; + if (avph.avp_length == 0) { + break; + } } } |