Ethereal-dev: [Ethereal-dev] Re: ethereal 0.10.8 radius/iapp dissector vuln

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Jonathan Heusser <jonny@xxxxxxxxxxxx>
Date: Wed, 22 Dec 2004 21:06:50 +0100
Guy Harris wrote:
The attached file is an example packet which let ethereal crash, (ab)using the tagged string case.
The current version in SVN doesn't crash, as one of the explicit AVP length checks I added makes sure you have at least one byte present for the tag in a tagged string - although it also doesn't report that there's a bad tagged string, so I'll have to see why that is.
Ok, I didn't see you already checked some changes in. I'm only referring to release 0.10.8.
In the current SVN code, the bailing out *is* done by calling "g_assert()", so that Ethereal will crash if a negative length is passed - as per the above, if that happens, there's a bug somewhere and it has to be fixed there. 

good.

--
Key fingerprint = 2A55 EB7C B7EA 6336 7767  4A47 910A 307B 1333 BD6C