Fix CVE-2023-1161

CVE-2023-1161.patch

@@ -0,0 +1,61 @@
+From 51e23ea7fd49cb04ba33db3bfbeba690a2f7c5b4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Dr=2E=20Lars=20V=C3=B6lker?=
+ <lars.voelker@technica-engineering.de>
+Date: Fri, 3 Feb 2023 19:42:03 +0100
+Subject: [PATCH] ISO15765/ISO10681 memory corruption bugfix
+
+Fixes a situation in which the code wrote behind the frag_id_high array
+and corrupted memory.
+
+Closes #18839
+---
+ epan/dissectors/packet-iso10681.c | 7 ++++++-
+ epan/dissectors/packet-iso15765.c | 8 ++++++--
+ 2 files changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/epan/dissectors/packet-iso10681.c b/epan/dissectors/packet-iso10681.c
+index 9e749eea8cf..6772e936e06 100644
+--- a/epan/dissectors/packet-iso10681.c
++++ b/epan/dissectors/packet-iso10681.c
+@@ -340,7 +340,12 @@ dissect_iso10681(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint32 fr
+             }
+ 
+             if (!(pinfo->fd->visited)) {
+-                frag_id += ((iso10681_frame->frag_id_high[frag_id]++) * 16);
++                DISSECTOR_ASSERT(frag_id < 16);
++                guint16 tmp = iso10681_frame->frag_id_high[frag_id]++;
++                /* Make sure that we assert on using more than 4096 (16*255) segments.*/
++                DISSECTOR_ASSERT(iso10681_frame->frag_id_high[frag_id] != 0);
++                frag_id += tmp * 16;
++
+                 /* Save the frag_id for subsequent dissection */
+                 iso10681_info->frag_id = frag_id;
+             }
+diff --git a/epan/dissectors/packet-iso15765.c b/epan/dissectors/packet-iso15765.c
+index 3157397bf21..4c73927c807 100644
+--- a/epan/dissectors/packet-iso15765.c
++++ b/epan/dissectors/packet-iso15765.c
+@@ -573,14 +573,18 @@ dissect_iso15765(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint32 bu
+         tvbuff_t *new_tvb = NULL;
+         iso15765_frame_t *iso15765_frame;
+         guint16 frag_id = frag_id_low;
+-
+         /* Get frame information */
+         iso15765_frame = (iso15765_frame_t *)wmem_map_lookup(iso15765_frame_table,
+                                                              GUINT_TO_POINTER(iso15765_info->seq));
+ 
+         if (iso15765_frame != NULL) {
+             if (!(pinfo->fd->visited)) {
+-                frag_id += ((iso15765_frame->frag_id_high[frag_id]++) * 16);
++                DISSECTOR_ASSERT(frag_id < 16);
++                guint16 tmp = iso15765_frame->frag_id_high[frag_id]++;
++                /* Make sure that we assert on using more than 4096 (16*255) segments.*/
++                DISSECTOR_ASSERT(iso15765_frame->frag_id_high[frag_id] != 0);
++                frag_id += tmp * 16;
++
+                 /* Save the frag_id for subsequent dissection */
+                 iso15765_info->frag_id = frag_id;
+ 
+-- 
+GitLab
+

wireshark.spec

@@ -5,7 +5,7 @@
 Summary:	Network traffic analyzer
 Name:		wireshark
 Version:	3.6.11
-Release:	1
+Release:	2
 Epoch:		1
 License:	GPL+
 Url:		http://www.wireshark.org/
@@ -21,6 +21,7 @@ Patch4:		wireshark-0004-Restore-Fedora-specific-groups.patch
 Patch5:		wireshark-0005-Fix-paths-in-a-wireshark.desktop-file.patch
 Patch6:		wireshark-0006-Move-tmp-to-var-tmp.patch
 Patch7:		wireshark-0007-cmakelists.patch
+Patch8:         CVE-2023-1161.patch
 
 Requires:	xdg-utils
 Requires:	hicolor-icon-theme
@@ -195,6 +196,9 @@ exit 0
 %{_mandir}/man?/*
 
 %changelog
+* Mon Mar 27 2023 yaoxin <yaoxin30@h-partners.com> - 1:3.6.11-2
+- Fix CVE-2023-1161
+
 * Tue Feb 14 2023 liyuxiang<liyuxiang@ncti-gba.cn> - 1:3.6.11-1
 - Update to 3.6.11