加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
文件
该仓库未声明开源许可证文件(LICENSE),使用请关注具体项目描述及其代码上游依赖。
克隆/下载
wireshark-0017-CVE-19623.patch 1.84 KB
一键复制 编辑 原始数据 按行查看 历史
张彬琛 提交于 2021-01-20 21:44 . import wireshark-2.6.2-12.el8.src.rpm
diff --git a/epan/dissectors/packet-lbmpdm.c b/epan/dissectors/packet-lbmpdm.c
index 0df59329fd..16001b859c 100644
--- a/epan/dissectors/packet-lbmpdm.c
+++ b/epan/dissectors/packet-lbmpdm.c
@@ -12,6 +12,7 @@
#include "config.h"
#include <epan/packet.h>
+#include <epan/exceptions.h>
#include "packet-lbm.h"
/* Magic number for message header to check if data is big-endian or little-endian. */
@@ -837,7 +838,6 @@ static int dissect_segment_ofstable(tvbuff_t * tvb, int offset, packet_info * pi
proto_tree * subtree = NULL;
int datalen = 0;
int seglen = 0;
- int datalen_remaining = 0;
int ofs = 0;
int field_count = 0;
int idx;
@@ -862,9 +862,8 @@ static int dissect_segment_ofstable(tvbuff_t * tvb, int offset, packet_info * pi
id_list[idx] = -1;
ofs_list[idx] = -1;
}
- datalen_remaining = datalen;
ofs = offset + L_LBMPDM_SEG_HDR_T;
- for (idx = 0; (idx < field_count) && (datalen_remaining >= L_LBMPDM_OFFSET_ENTRY_T); idx++, ofs += L_LBMPDM_OFFSET_ENTRY_T)
+ for (idx = 0; idx < field_count; idx++, ofs += L_LBMPDM_OFFSET_ENTRY_T)
{
proto_item * offset_item = NULL;
proto_tree * offset_tree = NULL;
@@ -875,6 +874,9 @@ static int dissect_segment_ofstable(tvbuff_t * tvb, int offset, packet_info * pi
id_list[idx] = (gint32)lbmpdm_fetch_uint32_encoded(tvb, ofs + O_LBMPDM_OFFSET_ENTRY_T_ID, encoding);
proto_tree_add_item(offset_tree, hf_lbmpdm_offset_entry_offset, tvb, ofs + O_LBMPDM_OFFSET_ENTRY_T_OFFSET, L_LBMPDM_OFFSET_ENTRY_T_OFFSET, encoding);
ofs_list[idx] = (gint32)lbmpdm_fetch_uint32_encoded(tvb, ofs + O_LBMPDM_OFFSET_ENTRY_T_OFFSET, encoding);
+ if (id_list[idx] < 0 || ofs_list[idx] < 0) {
+ THROW(ReportedBoundsError);
+ }
if (id_list[idx] > max_index)
{
max_index = id_list[idx];
马建仓 AI 助手
尝试更多
代码解读
代码找茬
代码优化