Wireshark-bugs: [Wireshark-bugs] [Bug 12112] Buildbot crash output: fuzz-2016-02-10-11754.pcap

Date: Thu, 11 Feb 2016 03:58:37 +0000

changed bug 12112


What Removed Added
Hardware x86-64 All
OS Ubuntu All

Comment # 1 on bug 12112 from
Line 1822 of asn1/nbap/nbap.cnf can set
umts_fp_conversation_info->hsdsch_macdflow_id to a value from 0 to
maxNrOfMACdFlows - 1.  maxNrOfMACdFlows is 8, so it can set it to a value
between 0 and 7.

Starting at line 57 of asn1/nbap/packet-nbap-template.h, we have:

/* 1 to 8*/
static const guint8 hsdsch_macdflow_id_rlc_map[] = {
    RLC_UM,               /*1 SRB */
    RLC_AM,            /*2 Interactive PS*/
    RLC_AM,               /*3 Interatcive PS*/
    RLC_UNKNOWN_MODE, /*4 ???*/
    RLC_AM,              /*5 Streaming PS*/
    RLC_UNKNOWN_MODE,
    RLC_UNKNOWN_MODE
    };

The introductory comment is wrong, as the valid 0-based indices in that array
range from 0 to 6, so 1-based indices go from 1 to 7, not from 1 to 8.  This
also means that if hsdsch_macdflow_id gets set to 7, you go past the end of the
array.

Should that array have one more RLC_UNKNOWN_MODE entry in it?


You are receiving this mail because:
  • You are watching all bug changes.