From 0f95d441e4b5d7512cc5c326c8668a120e048eda Mon Sep 17 00:00:00 2001 From: Guy Harris Date: Wed, 22 Oct 2014 12:31:21 -0700 Subject: [PATCH] Do bounds checking when unescaping PPP. Clean up a const issue while we're at it. Upstream commit 0f95d441e4b5d. Signed-off-by: Baruch Siach --- print-ppp.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/print-ppp.c b/print-ppp.c index 8e098f05a953..9a983e6179cd 100644 --- a/print-ppp.c +++ b/print-ppp.c @@ -1351,14 +1351,15 @@ static void ppp_hdlc(netdissect_options *ndo, const u_char *p, int length) { - u_char *b, *s, *t, c; + u_char *b, *t, c; + const u_char *s; int i, proto; const void *se; if (length <= 0) return; - b = (uint8_t *)malloc(length); + b = (u_char *)malloc(length); if (b == NULL) return; @@ -1367,14 +1368,13 @@ ppp_hdlc(netdissect_options *ndo, * Do this so that we dont overwrite the original packet * contents. */ - for (s = (u_char *)p, t = b, i = length; i > 0; i--) { + for (s = p, t = b, i = length; i > 0 && ND_TTEST(*s); i--) { c = *s++; if (c == 0x7d) { - if (i > 1) { - i--; - c = *s++ ^ 0x20; - } else - continue; + if (i <= 1 || !ND_TTEST(*s)) + break; + i--; + c = *s++ ^ 0x20; } *t++ = c; } -- 2.1.3