57 lines
2.4 KiB
Diff
57 lines
2.4 KiB
Diff
From 5aba3ed0cdebc1ec960261e3e9eda87c8408259f Mon Sep 17 00:00:00 2001
|
|
From: Dario Lombardo <lomato@gmail.com>
|
|
Date: Sun, 17 Mar 2019 00:47:02 +0100
|
|
Subject: [PATCH] dcerpc: ensure the length in the packet doesn't overcome the
|
|
boundaries.
|
|
|
|
The spoolss dissector creates a new source using the length from the packet
|
|
data. If it overcomes the ends of the packet we hit a crash. In this case
|
|
add an expert info and stop the dissection
|
|
|
|
Bug: 15568
|
|
Change-Id: Idfb0b54c1f41842170d3d03c80897a3b7edc9400
|
|
Reviewed-on: https://code.wireshark.org/review/32449
|
|
Petri-Dish: Anders Broman <a.broman58@gmail.com>
|
|
Tested-by: Petri Dish Buildbot
|
|
Reviewed-by: Anders Broman <a.broman58@gmail.com>
|
|
---
|
|
epan/dissectors/packet-dcerpc-spoolss.c | 9 +++++++++
|
|
1 file changed, 9 insertions(+)
|
|
|
|
diff --git a/epan/dissectors/packet-dcerpc-spoolss.c b/epan/dissectors/packet-dcerpc-spoolss.c
|
|
index 2bf8cc8..46b3d34 100644
|
|
--- a/epan/dissectors/packet-dcerpc-spoolss.c
|
|
+++ b/epan/dissectors/packet-dcerpc-spoolss.c
|
|
@@ -315,6 +315,7 @@ static expert_field ei_driver_info_level = EI_INIT;
|
|
static expert_field ei_level = EI_INIT;
|
|
static expert_field ei_notify_info_data_type = EI_INIT;
|
|
static expert_field ei_enumprinterdataex_value = EI_INIT;
|
|
+static expert_field ei_buffer_size_too_long = EI_INIT;
|
|
|
|
/* Registry data types */
|
|
|
|
@@ -441,6 +442,13 @@ dissect_spoolss_buffer_data(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
|
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
|
|
hf_buffer_size, &size);
|
|
|
|
+ /* Before going any further, we must ensure the bytes
|
|
+ actually esist in the tvb */
|
|
+ if ((guint32)tvb_reported_length_remaining(tvb, offset) < size) {
|
|
+ expert_add_info(pinfo, tree, &ei_buffer_size_too_long);
|
|
+ return offset;
|
|
+ }
|
|
+
|
|
offset = dissect_ndr_uint8s(tvb, offset, pinfo, NULL, di, drep,
|
|
hf_buffer_data, size, &data);
|
|
|
|
@@ -8315,6 +8323,7 @@ proto_register_dcerpc_spoolss(void)
|
|
{ &ei_level, { "spoolss.level.unknown", PI_PROTOCOL, PI_WARN, "Info level unknown", EXPFILL }},
|
|
{ &ei_notify_info_data_type, { "spoolss.notify_info_data.type.unknown", PI_PROTOCOL, PI_WARN, "Unknown notify type", EXPFILL }},
|
|
{ &ei_enumprinterdataex_value, { "spoolss.enumprinterdataex.val_unknown", PI_PROTOCOL, PI_WARN, "Unknown value type", EXPFILL }},
|
|
+ { &ei_buffer_size_too_long, { "spoolss.buffer.size.invalid", PI_PROTOCOL, PI_ERROR, "Buffer size too long", EXPFILL }},
|
|
};
|
|
|
|
expert_module_t* expert_dcerpc_spoolss;
|
|
--
|
|
2.7.4
|