Attachment 157939 Details for Bug 245797 – Patch for Wireshark DCP ETSI decoder that should fix an infinite loop

Patch for Wireshark DCP ETSI decoder that should fix an infinite loop

CVE-2007-3391-DCP.patch (text/x-patch), 2.08 KB, created by Lubomir Kundrak on 2007-06-26 19:01:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lubomir Kundrak

Created: 2007-06-26 19:01:34 UTC

Size: 2.08 KB

patch

obsolete

>38a39
>> #include <epan/emem.h>
>235c236
><   gboolean first, last, decoded = TRUE;
>---
>>   gboolean first, last;
>252c253
><     guint32 *got = g_malloc(fcount*sizeof(guint32));
>---
>>     guint32 *got = ep_alloc(fcount*sizeof(guint32));
>253a255
>> 	/* make a list of the findex (offset) numbers of the fragments we have */
>258,259c260
><         got[fragments] = fd_head->offset;
><         fragments++;
>---
>>         got[fragments++] = fd_head->offset; /* this is the findex of the fragment */
>262,263c263,267
>< 	if(fragments>=rx_min) {
><       guint i,j;
>---
>> 	/* put a sentinel at the end */
>>     got[fragments++] = fcount;
>> 	/* have we got enough for Reed Solomon to try to correct ? */
>> 	if(fragments>=rx_min) { /* yes, in theory */
>>       guint i,current_findex;
>265c269
><       guint8 *dummy_data = (guint8*) g_malloc (plen);
>---
>>       guint8 *dummy_data = (guint8*) ep_alloc0 (plen);
>272,286c276,282
><       memset(dummy_data, 0, plen);
><       for(i=0,j=0; i<fragments; i++,j++) {
><         while(j<got[i]) {
><           frag = fragment_add_seq_check (dummytvb, 0, pinfo, seq,
><             dcp_fragment_table, dcp_reassembled_table, j, plen, (j+1!=fcount));
>< 	  if(tree) {
><               proto_tree_add_text (tree, tvb, 0, -1, "missing %d", j);
><               if(frag) {
><                 proto_tree_add_text (tree, tvb, 0, -1, "fragment %d was what we needed", j);
><                 break;
><               } else {
><                 proto_tree_add_text (tree, tvb, 0, -1, "added %d but still not reassembled", j);
><               }
><           }
><           j++;
>---
>> 	  /* fill the fragment table with empty fragments */
>> 	  current_findex = 0;
>>       for(i=0; i<fragments; i++) {
>> 	    guint next_fragment_we_have = got[i];
>>         for(; current_findex<next_fragment_we_have; current_findex++) {
>>           frag = fragment_add_seq_check (dummytvb, 0, pinfo, seq,	
>>             dcp_fragment_table, dcp_reassembled_table, current_findex, plen, (current_findex+1!=fcount));
>287a284
>> 		current_findex++; /* skip over the fragment we have */
>295d291
><     g_free(got);
>297a294
>>     gboolean decoded = TRUE;

Actions: View

Attachments on bug 245797: 157938 | 157939