[Wireshark code review <code-review-do-not-reply@xxxxxxxxxxxxx>]

URL: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=f6e92b212f8755d34482a2269c21895ce327cc07
Submitter: Peter Wu (peter@xxxxxxxxxxxxx)
Changed: branch: master-2.4
Repository: wireshark

Commits:

f6e92b2 by Peter Wu (peter@xxxxxxxxxxxxx):

    tvbuff_zlib: reject negative lengths to avoid buffer overrun
    
    Negative lengths and empty buffers are not uncompressable, reject them.
    A buffer overrun (read) could occur otherwise due to unsigned "avail_in"
    becoming insanely large.
    
    Bug: 14675
    Change-Id: I20b686cc6ad6ef8a8d1975ed3d2f52c8eb1f1c76
    Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7166
    Reviewed-on: https://code.wireshark.org/review/27561
    Petri-Dish: Peter Wu <peter@xxxxxxxxxxxxx>
    Tested-by: Petri Dish Buildbot
    Reviewed-by: Anders Broman <a.broman58@xxxxxxxxx>
    (cherry picked from commit 9ee790e99c72ddb5b599b8076b4ecf74611b184e)
    Reviewed-on: https://code.wireshark.org/review/27900
    Reviewed-by: Peter Wu <peter@xxxxxxxxxxxxx>
    

Actions performed:

    from  04c44d8   Fix test for early exit from MMSE dissector.
    adds  f6e92b2   tvbuff_zlib: reject negative lengths to avoid buffer overrun


Summary of changes:
 epan/tvbuff_zlib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)