62 lines
2.6 KiB
Diff
62 lines
2.6 KiB
Diff
From 51e23ea7fd49cb04ba33db3bfbeba690a2f7c5b4 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Dr=2E=20Lars=20V=C3=B6lker?=
|
|
<lars.voelker@technica-engineering.de>
|
|
Date: Fri, 3 Feb 2023 19:42:03 +0100
|
|
Subject: [PATCH] ISO15765/ISO10681 memory corruption bugfix
|
|
|
|
Fixes a situation in which the code wrote behind the frag_id_high array
|
|
and corrupted memory.
|
|
|
|
Closes #18839
|
|
---
|
|
epan/dissectors/packet-iso10681.c | 7 ++++++-
|
|
epan/dissectors/packet-iso15765.c | 8 ++++++--
|
|
2 files changed, 12 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/epan/dissectors/packet-iso10681.c b/epan/dissectors/packet-iso10681.c
|
|
index 9e749eea8cf..6772e936e06 100644
|
|
--- a/epan/dissectors/packet-iso10681.c
|
|
+++ b/epan/dissectors/packet-iso10681.c
|
|
@@ -340,7 +340,12 @@ dissect_iso10681(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint32 fr
|
|
}
|
|
|
|
if (!(pinfo->fd->visited)) {
|
|
- frag_id += ((iso10681_frame->frag_id_high[frag_id]++) * 16);
|
|
+ DISSECTOR_ASSERT(frag_id < 16);
|
|
+ guint16 tmp = iso10681_frame->frag_id_high[frag_id]++;
|
|
+ /* Make sure that we assert on using more than 4096 (16*255) segments.*/
|
|
+ DISSECTOR_ASSERT(iso10681_frame->frag_id_high[frag_id] != 0);
|
|
+ frag_id += tmp * 16;
|
|
+
|
|
/* Save the frag_id for subsequent dissection */
|
|
iso10681_info->frag_id = frag_id;
|
|
}
|
|
diff --git a/epan/dissectors/packet-iso15765.c b/epan/dissectors/packet-iso15765.c
|
|
index 3157397bf21..4c73927c807 100644
|
|
--- a/epan/dissectors/packet-iso15765.c
|
|
+++ b/epan/dissectors/packet-iso15765.c
|
|
@@ -573,14 +573,18 @@ dissect_iso15765(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint32 bu
|
|
tvbuff_t *new_tvb = NULL;
|
|
iso15765_frame_t *iso15765_frame;
|
|
guint16 frag_id = frag_id_low;
|
|
-
|
|
/* Get frame information */
|
|
iso15765_frame = (iso15765_frame_t *)wmem_map_lookup(iso15765_frame_table,
|
|
GUINT_TO_POINTER(iso15765_info->seq));
|
|
|
|
if (iso15765_frame != NULL) {
|
|
if (!(pinfo->fd->visited)) {
|
|
- frag_id += ((iso15765_frame->frag_id_high[frag_id]++) * 16);
|
|
+ DISSECTOR_ASSERT(frag_id < 16);
|
|
+ guint16 tmp = iso15765_frame->frag_id_high[frag_id]++;
|
|
+ /* Make sure that we assert on using more than 4096 (16*255) segments.*/
|
|
+ DISSECTOR_ASSERT(iso15765_frame->frag_id_high[frag_id] != 0);
|
|
+ frag_id += tmp * 16;
|
|
+
|
|
/* Save the frag_id for subsequent dissection */
|
|
iso15765_info->frag_id = frag_id;
|
|
|
|
--
|
|
GitLab
|
|
|