Blame SOURCES/wireshark-1.10.6-CVE-2014-2281.patch
|
 |
6415a4 |
diff --git a/epan/dissectors/packet-nfs.c b/epan/dissectors/packet-nfs.c
|
|
|
6415a4 |
index 414e928..eb005e0 100644
|
|
|
6415a4 |
--- a/epan/dissectors/packet-nfs.c
|
|
|
6415a4 |
+++ b/epan/dissectors/packet-nfs.c
|
|
|
6415a4 |
@@ -950,24 +950,31 @@ nfs_name_snoop_add_name(int xid, tvbuff_t *tvb, int name_offset, int name_len, i
|
|
|
6415a4 |
nfs_name_snoop_t *nns, *old_nns;
|
|
|
6415a4 |
const char *ptr=NULL;
|
|
|
6415a4 |
|
|
|
6415a4 |
+ if (name_len <= 0) {
|
|
|
6415a4 |
+ /* Do we need some way to signal an error here? This could be
|
|
|
6415a4 |
+ * programmatic or just a corrupt packet, depending on the
|
|
|
6415a4 |
+ * caller... */
|
|
|
6415a4 |
+ return;
|
|
|
6415a4 |
+ }
|
|
|
6415a4 |
+
|
|
|
6415a4 |
/* filter out all '.' and '..' names */
|
|
|
6415a4 |
if(!name){
|
|
|
6415a4 |
ptr=(const char *)tvb_get_ptr(tvb, name_offset, name_len);
|
|
|
6415a4 |
} else {
|
|
|
6415a4 |
ptr=name;
|
|
|
6415a4 |
}
|
|
|
6415a4 |
- if(ptr[0]=='.'){
|
|
|
6415a4 |
- if(ptr[1]==0){
|
|
|
6415a4 |
+ if (ptr[0] == '.') {
|
|
|
6415a4 |
+ if (name_len <= 1 || ptr[1] == 0) {
|
|
|
6415a4 |
return;
|
|
|
6415a4 |
}
|
|
|
6415a4 |
- if(ptr[1]=='.'){
|
|
|
6415a4 |
- if(ptr[2]==0){
|
|
|
6415a4 |
+ if (ptr[1] == '.') {
|
|
|
6415a4 |
+ if (name_len <= 2 || ptr[2] == 0) {
|
|
|
6415a4 |
return;
|
|
|
6415a4 |
}
|
|
|
6415a4 |
}
|
|
|
6415a4 |
}
|
|
|
6415a4 |
|
|
|
6415a4 |
- nns=(nfs_name_snoop_t *)g_malloc(sizeof(nfs_name_snoop_t));
|
|
|
6415a4 |
+ nns = g_new(nfs_name_snoop_t, 1);
|
|
|
6415a4 |
|
|
|
6415a4 |
nns->fh_length=0;
|
|
|
6415a4 |
nns->fh=NULL;
|