Wireshark-bugs: [Wireshark-bugs] [Bug 12119] Buildbot crash output: fuzz-2016-02-11-28355.pcap
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Fri, 01 Apr 2016 02:09:08 +0000

Comment # 4 on bug 12119 from 
I think the best solution would be to try to get the "tap data" (si variable)
as close to the top of a function as possible.  Then you could put a if
(ptvcursor_tree(cursor) == NULL) right after all of the uses.  Hopefully that
can eliminate all of the loops.
Barring that, you need to have sanity checks after grabbing any loop value from
the packet and checking if its loop size is too big for the packet.
Using this capture as an example, in handle_UpdateCapabilitiesV3Message, there
should be a check if (audioCapCount * "size of audio capability structure") is
greater than reported length of tvb, then return from function.

You are receiving this mail because:
  • You are watching all bug changes.