Wireshark · Ethereal-dev: Re: [Ethereal-dev] Re: [Coverity] Possible Format String Vulnerabilites

[Guy Harris <gharris@xxxxxxxxx>]

Bryan Fulton wrote:

> Bug 3:
> /ethereal-0.10.10/epan/dissectors/packet-manolito.c:dissect_manolito
> - length pulled off a tvb via tvb_get_guint8(), and length+1 is
> passed to malloc without proper bounds checking. Possible integer
> overflow on the allocation

How so?  At least from my reading of the C89 standard, "length" is 
converted to "int" when 1 is added to it, so you won't overflow the 
"unsigned char" that "length" probably is.  I.e., as "length" is in the 
range 0 to 255, "length + 1" is in the range 1 to 256.