Ethereal-dev: [Ethereal-dev] Possible problem in packet-gtp [negative length tvb_memcpy()] ?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Yaniv Kaul <ykaul@xxxxxxxxxxxx>
Date: Sun, 28 Mar 2004 11:06:21 +0200
In packet-gtp.c, is there a problem in the following routine, if length = 1 ?
decode_gtp_priv_ext(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree) { 

   guint16        length, ext_id;
   gchar        ext_val[64];
   proto_tree    *ext_tree_priv_ext;
   proto_item    *te;
te = proto_tree_add_text(tree, tvb, offset, 1, val_to_str(GTP_EXT_PRIV_EXT, gtp_val, "Unknown message")); 
   ext_tree_priv_ext = proto_item_add_subtree(te, ett_gtp_ext);

   length = tvb_get_ntohs(tvb, offset+1);
   if (length < 1) return 3+length;

   ext_id = tvb_get_ntohs(tvb, offset+3);
   tvb_memcpy(tvb, ext_val, offset+5, length > 65 ? 63 : length-2);