http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1972
------- Comment #3 from florent.drouin@xxxxxxxxxx 2007-11-05 14:23 GMT -------
There is a test missing in the erf_open function in wiretap/erf.c
we have to check the length of the first ERF headers to validate the file
format.
<<
wireshark_TRUNK23365$ diff -u wiretap/erf.c.ori wiretap/erf.c
--- wiretap/erf.c.ori 2007-11-01 07:23:20.000000000 +0100
+++ wiretap/erf.c 2007-11-05 15:11:08.000000000 +0100
@@ -120,6 +120,14 @@
packet_size = g_ntohs(header.rlen) - sizeof(header);
+ if (packet_size > WTAP_MAX_PACKET_SIZE) {
+ /*
+ * Probably a corrupt capture file; don't blow up trying
+ * to allocate space for an immensely-large packet.
+ */
+ return 0;
+ }
+
/* fail on invalid record type, decreasing timestamps or non-zero pad-bits
*/
/* Not all types within this range are decoded, but it is a first filter
*/
if (header.type == 0 || header.type > ERF_TYPE_MAX ) {
>>
--
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
