URL: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=ac94382d971e722ab847b758e7d4753a2f1ee32f
Submitter: Guy Harris (guy@xxxxxxxxxxxx)
Changed: branch: master-2.4
Repository: wireshark
Commits:
ac94382 by Peter Wu (peter@xxxxxxxxxxxxx):
ber: fix buffer overrun (read) in dissect_ber_constrained_bitstring
The length is an unsigned integer, but some users (such as tvb_memdup)
expect signed integers and treat negative values specially.
Bug: 14682
Change-Id: Ic3330d23d964b5cc44718b61c8985880f901674d
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8011
Reviewed-on: https://code.wireshark.org/review/27562
Petri-Dish: Peter Wu <peter@xxxxxxxxxxxxx>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@xxxxxxxxx>
(cherry picked from commit df5a8b29bbb046933b73e9e369b9bc9e4b03aaa8)
Reviewed-on: https://code.wireshark.org/review/27963
Reviewed-by: Guy Harris <guy@xxxxxxxxxxxx>
Actions performed:
from 8f1afb1 And removing the DISSECTOR_ASSERT() checks brought bug 14738 back.
adds ac94382 ber: fix buffer overrun (read) in dissect_ber_constrained_bitstring
Summary of changes:
epan/dissectors/packet-ber.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)