net-analyzer/wireshark/files/wireshark-1.6.10-CVE-2012-3548.patch


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

--- a/epan/dissectors/packet-drda.c
+++ b/epan/dissectors/packet-drda.c
@@ -49,6 +49,7 @@
 #include <epan/packet.h>
 #include <epan/conversation.h>
 #include <epan/prefs.h>
+#include <epan/expert.h>
 #include "packet-tcp.h"
 
 static int proto_drda = -1;
@@ -694,6 +695,10 @@
 	{
 		iCommand = tvb_get_ntohs(tvb, offset + 8);
 		iLength = tvb_get_ntohs(tvb, offset + 0);
+		if (iLength < 10) {
+			expert_add_info_format(pinfo, NULL, PI_MALFORMED, PI_ERROR, "Invalid length detected (%u): should be at least 10 bytes long", iLength);
+			break;
+		}
 		/* iCommandEnd is the length of the packet up to the end of the current command */
 		iCommandEnd += iLength;