|
 |
b1047b |
diff -u b/epan/dissectors/packet-ieee80211-radiotap-iter.c b/epan/dissectors/packet-ieee80211-radiotap-iter.c
|
|
|
b1047b |
--- b/epan/dissectors/packet-ieee80211-radiotap-iter.c
|
|
|
b1047b |
+++ b/epan/dissectors/packet-ieee80211-radiotap-iter.c
|
|
|
b1047b |
@@ -120,6 +120,9 @@
|
|
|
b1047b |
struct ieee80211_radiotap_header *radiotap_header,
|
|
|
b1047b |
int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns)
|
|
|
b1047b |
{
|
|
|
b1047b |
+ if (max_length < (int)sizeof(struct ieee80211_radiotap_header))
|
|
|
b1047b |
+ return -EINVAL;
|
|
|
b1047b |
+
|
|
|
b1047b |
/* Linux only supports version 0 radiotap format */
|
|
|
b1047b |
if (radiotap_header->it_version)
|
|
|
b1047b |
return -EINVAL;
|
|
|
b1047b |
@@ -131,6 +134,7 @@
|
|
|
b1047b |
iterator->_bitmap_shifter = get_unaligned_le32(&radiotap_header->it_present);
|
|
|
b1047b |
iterator->_arg = (guint8 *)radiotap_header + sizeof(*radiotap_header);
|
|
|
b1047b |
iterator->_reset_on_ext = 0;
|
|
|
b1047b |
+ iterator->_next_ns_data = NULL;
|
|
|
b1047b |
iterator->_next_bitmap = &radiotap_header->it_present;
|
|
|
b1047b |
iterator->_next_bitmap++;
|
|
|
b1047b |
iterator->_vns = vns;
|
|
|
b1047b |
@@ -146,9 +150,11 @@
|
|
|
b1047b |
|
|
|
b1047b |
/* find payload start allowing for extended bitmap(s) */
|
|
|
b1047b |
|
|
|
b1047b |
- if (iterator->_bitmap_shifter & (1<
|
|
|
b1047b |
+ if (iterator->_bitmap_shifter & (1U<
|
|
|
b1047b |
+ if(!ITERATOR_VALID(iterator, sizeof(guint32)))
|
|
|
b1047b |
+ return -EINVAL;
|
|
|
b1047b |
while (get_unaligned_le32(iterator->_arg) &
|
|
|
b1047b |
- (1 << IEEE80211_RADIOTAP_EXT)) {
|
|
|
b1047b |
+ (1U << IEEE80211_RADIOTAP_EXT)) {
|
|
|
b1047b |
iterator->_arg += sizeof(guint32);
|
|
|
b1047b |
|
|
|
b1047b |
/*
|
|
|
b1047b |
@@ -157,7 +163,7 @@
|
|
|
b1047b |
* stated radiotap header length
|
|
|
b1047b |
*/
|
|
|
b1047b |
|
|
|
b1047b |
- if (!ITERATOR_VALID(iterator, 0))
|
|
|
b1047b |
+ if (!ITERATOR_VALID(iterator, sizeof(guint32)))
|
|
|
b1047b |
return -EINVAL;
|
|
|
b1047b |
}
|
|
|
b1047b |
|
|
|
b1047b |
@@ -287,9 +293,14 @@
|
|
|
b1047b |
}
|
|
|
b1047b |
if (!align) {
|
|
|
b1047b |
/* skip all subsequent data */
|
|
|
b1047b |
+ if (!iterator->_next_ns_data)
|
|
|
b1047b |
+ return -EINVAL;
|
|
|
b1047b |
iterator->_arg = iterator->_next_ns_data;
|
|
|
b1047b |
/* give up on this namespace */
|
|
|
b1047b |
iterator->current_namespace = NULL;
|
|
|
b1047b |
+ iterator->_next_ns_data = NULL;
|
|
|
b1047b |
+ if (!ITERATOR_VALID(iterator, 0))
|
|
|
b1047b |
+ return -EINVAL;
|
|
|
b1047b |
goto next_entry;
|
|
|
b1047b |
}
|
|
|
b1047b |
break;
|
|
|
b1047b |
diff --git a/epan/dissectors/packet-ieee80211-radiotap.c.old b/epan/dissectors/packet-ieee80211-radiotap.c
|
|
|
b1047b |
index fd8ad89..c4945a8 100644
|
|
|
b1047b |
--- a/epan/dissectors/packet-ieee80211-radiotap.c.old
|
|
|
b1047b |
+++ b/epan/dissectors/packet-ieee80211-radiotap.c
|
|
|
b1047b |
@@ -49,6 +49,7 @@ static int proto_radiotap = -1;
|
|
|
b1047b |
static int hf_radiotap_version = -1;
|
|
|
b1047b |
static int hf_radiotap_pad = -1;
|
|
|
b1047b |
static int hf_radiotap_length = -1;
|
|
|
b1047b |
+static int hf_radiotap_invalid_header_length = -1;
|
|
|
b1047b |
static int hf_radiotap_present = -1;
|
|
|
b1047b |
static int hf_radiotap_mactime = -1;
|
|
|
b1047b |
/* static int hf_radiotap_channel = -1; */
|
|
|
b1047b |
@@ -1024,6 +1025,14 @@ dissect_radiotap(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree)
|
|
|
b1047b |
tvb, 2, 2, length);
|
|
|
b1047b |
}
|
|
|
b1047b |
|
|
|
b1047b |
+ /*
|
|
|
b1047b |
+ * The length is the length of the entire radiotap header, so it
|
|
|
b1047b |
+ * must be at least 8, for the version, padding, length, and first
|
|
|
b1047b |
+ * presence flags word.
|
|
|
b1047b |
+ */
|
|
|
b1047b |
+ if (length < 8)
|
|
|
b1047b |
+ return;
|
|
|
b1047b |
+
|
|
|
b1047b |
data = ep_tvb_memdup(tvb, 0, length);
|
|
|
b1047b |
if (!data)
|
|
|
b1047b |
return;
|
|
|
b1047b |
@@ -1990,6 +1999,11 @@ void proto_register_radiotap(void)
|
|
|
b1047b |
FT_UINT8, BASE_DEC, NULL, 0x0,
|
|
|
b1047b |
"Padding", HFILL}},
|
|
|
b1047b |
|
|
|
b1047b |
+ {&hf_radiotap_invalid_header_length,
|
|
|
b1047b |
+ {"Present flags", "radiotap.length.invalid",
|
|
|
b1047b |
+ FT_NONE, BASE_NONE, NULL, 0x0,
|
|
|
b1047b |
+ "The radiotap header length is less than 8 bytes", HFILL}},
|
|
|
b1047b |
+
|
|
|
b1047b |
{&hf_radiotap_length,
|
|
|
b1047b |
{"Header length", "radiotap.length",
|
|
|
b1047b |
FT_UINT16, BASE_DEC, NULL, 0x0,
|