Blame SOURCES/wireshark-1.10.14-CVE-2018-14368.patch

b1047b
diff --git a/epan/dissectors/packet-bzr.c.old b/epan/dissectors/packet-bzr.c
b1047b
index be1becb..94d1c7f 100644
b1047b
--- a/epan/dissectors/packet-bzr.c.old
b1047b
+++ b/epan/dissectors/packet-bzr.c
ae5d7c
@@ -85,7 +85,7 @@ static guint
ae5d7c
 get_bzr_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset)
ae5d7c
 {
ae5d7c
     int    next_offset;
ae5d7c
-    gint   len = 0;
ae5d7c
+    gint   len = 0, current_len; 
ae5d7c
     gint   protocol_version_len;
ae5d7c
     guint8 cmd = 0;
ae5d7c
ae5d7c
@@ -98,7 +98,10 @@ get_bzr_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset)
ae5d7c
     len += protocol_version_len + 1;
ae5d7c
ae5d7c
     /* Headers */
ae5d7c
+    current_len = len;
ae5d7c
     len += get_bzr_prefixed_len(tvb, next_offset);
ae5d7c
+    if (current_len > len) /* Make sure we're not going backwards */
ae5d7c
+       return -1;
ae5d7c
ae5d7c
     while (tvb_reported_length_remaining(tvb, offset + len) > 0) {
ae5d7c
         cmd = tvb_get_guint8(tvb, offset + len);
ae5d7c
@@ -107,7 +110,10 @@ get_bzr_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset)
ae5d7c
         switch (cmd) {
ae5d7c
         case 's':
ae5d7c
         case 'b':
ae5d7c
+            current_len = len;
ae5d7c
             len += get_bzr_prefixed_len(tvb, offset + len);
ae5d7c
+            if (current_len > len) /* Make sure we're not going backwards */
ae5d7c
+               return -1;
ae5d7c
             break;
ae5d7c
         case 'o':
ae5d7c
             len += 1;
b1047b
@@ -130,8 +130,8 @@ dissect_prefixed_bencode(tvbuff_t *tvb, gint offset, packet_info *pinfo _U_,
b1047b
 
b1047b
     plen = tvb_get_ntohl(tvb, offset);
b1047b
 
b1047b
-    ti = proto_tree_add_item(tree, hf_bzr_prefixed_bencode, tvb, offset, 4 +
b1047b
-                             plen, ENC_NA);
b1047b
+    ti = proto_tree_add_item(tree, hf_bzr_prefixed_bencode, tvb, offset, -1,
b1047b
+                             ENC_NA);
b1047b
     prefixed_bencode_tree = proto_item_add_subtree(ti, ett_prefixed_bencode);
b1047b
 
b1047b
     if (prefixed_bencode_tree)
b1047b
@@ -143,6 +143,8 @@ dissect_prefixed_bencode(tvbuff_t *tvb, gint offset, packet_info *pinfo _U_,
b1047b
                             tvb, offset+4, plen, ENC_NA);
b1047b
     }
b1047b
 
b1047b
+    proto_item_set_len(ti, 4 + plen);
b1047b
+
b1047b
     return 4 + plen;
b1047b
 }
b1047b
 
b1047b
@@ -156,18 +158,16 @@ dissect_prefixed_bytes(tvbuff_t *tvb, gint offset, packet_info *pinfo _U_,
b1047b
 
b1047b
     plen = tvb_get_ntohl(tvb, offset);
b1047b
 
b1047b
-    ti = proto_tree_add_item(tree, hf_bzr_bytes, tvb, offset, 4 +
b1047b
-                             plen, ENC_NA);
b1047b
+    ti = proto_tree_add_item(tree, hf_bzr_bytes, tvb, offset, -1, ENC_NA);
b1047b
     prefixed_bytes_tree = proto_item_add_subtree(ti, ett_prefixed_bytes);
b1047b
 
b1047b
-    if (prefixed_bytes_tree)
b1047b
-    {
b1047b
-        proto_tree_add_item(prefixed_bytes_tree, hf_bzr_bytes_length,
b1047b
-                            tvb, offset, 4, ENC_BIG_ENDIAN);
b1047b
+    proto_tree_add_item(prefixed_bytes_tree, hf_bzr_bytes_length,
b1047b
+                        tvb, offset, 4, ENC_BIG_ENDIAN);
b1047b
 
b1047b
-        proto_tree_add_item(prefixed_bytes_tree, hf_bzr_bytes_data,
b1047b
-                            tvb, offset+4, plen, ENC_NA);
b1047b
-    }
b1047b
+    proto_tree_add_item(prefixed_bytes_tree, hf_bzr_bytes_data,
b1047b
+                        tvb, offset+4, plen, ENC_NA);
b1047b
+    
b1047b
+    proto_item_set_len(ti, 4 + plen);
b1047b
 
b1047b
     return 4 + plen;
b1047b
 }
b1047b
@@ -267,7 +267,7 @@ proto_register_bzr(void)
b1047b
             NULL, 0x0, NULL, HFILL },
b1047b
         },
b1047b
         { &hf_bzr_prefixed_bencode,
b1047b
-          { "Bencode packet", "bzr.bencode", FT_BYTES, BASE_NONE, NULL, 0x0,
b1047b
+          { "Bencode packet", "bzr.bencode", FT_NONE, BASE_NONE, NULL, 0x0,
b1047b
             "Serialized structure of integers, dictionaries, strings and "
b1047b
             "lists.", HFILL },
b1047b
         },
b1047b
@@ -280,7 +280,7 @@ proto_register_bzr(void)
b1047b
             NULL, 0x0, NULL, HFILL },
b1047b
         },
b1047b
         { &hf_bzr_bytes,
b1047b
-          { "Prefixed bytes", "bzr.bytes", FT_BYTES, BASE_NONE, NULL, 0x0,
b1047b
+          { "Prefixed bytes", "bzr.bytes", FT_NONE, BASE_NONE, NULL, 0x0,
b1047b
             "Bytes field with prefixed 32-bit length", HFILL },
b1047b
         },
b1047b
         { &hf_bzr_bytes_data,