Blame SOURCES/wireshark-1.10.14-CVE-2018-14368.patch

a65ffb
diff --git a/epan/dissectors/packet-bzr.c.old b/epan/dissectors/packet-bzr.c
a65ffb
index be1becb..94d1c7f 100644
a65ffb
--- a/epan/dissectors/packet-bzr.c.old
a65ffb
+++ b/epan/dissectors/packet-bzr.c
a65ffb
@@ -85,7 +85,7 @@ static guint
a65ffb
 get_bzr_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset)
a65ffb
 {
a65ffb
     int    next_offset;
a65ffb
-    gint   len = 0;
a65ffb
+    gint   len = 0, current_len; 
a65ffb
     gint   protocol_version_len;
a65ffb
     guint8 cmd = 0;
a65ffb
a65ffb
@@ -98,7 +98,10 @@ get_bzr_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset)
a65ffb
     len += protocol_version_len + 1;
a65ffb
a65ffb
     /* Headers */
a65ffb
+    current_len = len;
a65ffb
     len += get_bzr_prefixed_len(tvb, next_offset);
a65ffb
+    if (current_len > len) /* Make sure we're not going backwards */
a65ffb
+       return -1;
a65ffb
a65ffb
     while (tvb_reported_length_remaining(tvb, offset + len) > 0) {
a65ffb
         cmd = tvb_get_guint8(tvb, offset + len);
a65ffb
@@ -107,7 +110,10 @@ get_bzr_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset)
a65ffb
         switch (cmd) {
a65ffb
         case 's':
a65ffb
         case 'b':
a65ffb
+            current_len = len;
a65ffb
             len += get_bzr_prefixed_len(tvb, offset + len);
a65ffb
+            if (current_len > len) /* Make sure we're not going backwards */
a65ffb
+               return -1;
a65ffb
             break;
a65ffb
         case 'o':
a65ffb
             len += 1;
a65ffb
@@ -130,8 +130,8 @@ dissect_prefixed_bencode(tvbuff_t *tvb, gint offset, packet_info *pinfo _U_,
a65ffb
 
a65ffb
     plen = tvb_get_ntohl(tvb, offset);
a65ffb
 
a65ffb
-    ti = proto_tree_add_item(tree, hf_bzr_prefixed_bencode, tvb, offset, 4 +
a65ffb
-                             plen, ENC_NA);
a65ffb
+    ti = proto_tree_add_item(tree, hf_bzr_prefixed_bencode, tvb, offset, -1,
a65ffb
+                             ENC_NA);
a65ffb
     prefixed_bencode_tree = proto_item_add_subtree(ti, ett_prefixed_bencode);
a65ffb
 
a65ffb
     if (prefixed_bencode_tree)
a65ffb
@@ -143,6 +143,8 @@ dissect_prefixed_bencode(tvbuff_t *tvb, gint offset, packet_info *pinfo _U_,
a65ffb
                             tvb, offset+4, plen, ENC_NA);
a65ffb
     }
a65ffb
 
a65ffb
+    proto_item_set_len(ti, 4 + plen);
a65ffb
+
a65ffb
     return 4 + plen;
a65ffb
 }
a65ffb
 
a65ffb
@@ -156,18 +158,16 @@ dissect_prefixed_bytes(tvbuff_t *tvb, gint offset, packet_info *pinfo _U_,
a65ffb
 
a65ffb
     plen = tvb_get_ntohl(tvb, offset);
a65ffb
 
a65ffb
-    ti = proto_tree_add_item(tree, hf_bzr_bytes, tvb, offset, 4 +
a65ffb
-                             plen, ENC_NA);
a65ffb
+    ti = proto_tree_add_item(tree, hf_bzr_bytes, tvb, offset, -1, ENC_NA);
a65ffb
     prefixed_bytes_tree = proto_item_add_subtree(ti, ett_prefixed_bytes);
a65ffb
 
a65ffb
-    if (prefixed_bytes_tree)
a65ffb
-    {
a65ffb
-        proto_tree_add_item(prefixed_bytes_tree, hf_bzr_bytes_length,
a65ffb
-                            tvb, offset, 4, ENC_BIG_ENDIAN);
a65ffb
+    proto_tree_add_item(prefixed_bytes_tree, hf_bzr_bytes_length,
a65ffb
+                        tvb, offset, 4, ENC_BIG_ENDIAN);
a65ffb
 
a65ffb
-        proto_tree_add_item(prefixed_bytes_tree, hf_bzr_bytes_data,
a65ffb
-                            tvb, offset+4, plen, ENC_NA);
a65ffb
-    }
a65ffb
+    proto_tree_add_item(prefixed_bytes_tree, hf_bzr_bytes_data,
a65ffb
+                        tvb, offset+4, plen, ENC_NA);
a65ffb
+    
a65ffb
+    proto_item_set_len(ti, 4 + plen);
a65ffb
 
a65ffb
     return 4 + plen;
a65ffb
 }
a65ffb
@@ -267,7 +267,7 @@ proto_register_bzr(void)
a65ffb
             NULL, 0x0, NULL, HFILL },
a65ffb
         },
a65ffb
         { &hf_bzr_prefixed_bencode,
a65ffb
-          { "Bencode packet", "bzr.bencode", FT_BYTES, BASE_NONE, NULL, 0x0,
a65ffb
+          { "Bencode packet", "bzr.bencode", FT_NONE, BASE_NONE, NULL, 0x0,
a65ffb
             "Serialized structure of integers, dictionaries, strings and "
a65ffb
             "lists.", HFILL },
a65ffb
         },
a65ffb
@@ -280,7 +280,7 @@ proto_register_bzr(void)
a65ffb
             NULL, 0x0, NULL, HFILL },
a65ffb
         },
a65ffb
         { &hf_bzr_bytes,
a65ffb
-          { "Prefixed bytes", "bzr.bytes", FT_BYTES, BASE_NONE, NULL, 0x0,
a65ffb
+          { "Prefixed bytes", "bzr.bytes", FT_NONE, BASE_NONE, NULL, 0x0,
a65ffb
             "Bytes field with prefixed 32-bit length", HFILL },
a65ffb
         },
a65ffb
         { &hf_bzr_bytes_data,