Skip to content

Commit 32027e1

Browse files
guyharrisfxlb
authored andcommitted
PPP: When un-escaping, don't allocate a too-large buffer.
The buffer should be big enough to hold the captured data, but it doesn't need to be big enough to hold the entire on-the-network packet, if we haven't captured all of it. (backported from commit e4add0b)
1 parent d95da9e commit 32027e1

File tree

1 file changed

+14
-4
lines changed

1 file changed

+14
-4
lines changed

Diff for: print-ppp.c

+14-4
Original file line numberDiff line numberDiff line change
@@ -1367,19 +1367,29 @@ print_bacp_config_options(netdissect_options *ndo,
13671367
return 0;
13681368
}
13691369

1370+
/*
1371+
* Un-escape RFC 1662 PPP in HDLC-like framing, with octet escapes.
1372+
* The length argument is the on-the-wire length, not the captured
1373+
* length; we can only un-escape the captured part.
1374+
*/
13701375
static void
13711376
ppp_hdlc(netdissect_options *ndo,
13721377
const u_char *p, int length)
13731378
{
1379+
u_int caplen = ndo->ndo_snapend - p;
13741380
u_char *b, *t, c;
13751381
const u_char *s;
1376-
int i, proto;
1382+
u_int i;
1383+
int proto;
13771384
const void *se;
13781385

1386+
if (caplen == 0)
1387+
return;
1388+
13791389
if (length <= 0)
13801390
return;
13811391

1382-
b = (u_char *)malloc(length);
1392+
b = (u_char *)malloc(caplen);
13831393
if (b == NULL)
13841394
return;
13851395

@@ -1388,10 +1398,10 @@ ppp_hdlc(netdissect_options *ndo,
13881398
* Do this so that we dont overwrite the original packet
13891399
* contents.
13901400
*/
1391-
for (s = p, t = b, i = length; i > 0 && ND_TTEST(*s); i--) {
1401+
for (s = p, t = b, i = caplen; i != 0; i--) {
13921402
c = *s++;
13931403
if (c == 0x7d) {
1394-
if (i <= 1 || !ND_TTEST(*s))
1404+
if (i <= 1)
13951405
break;
13961406
i--;
13971407
c = *s++ ^ 0x20;

0 commit comments

Comments
 (0)