Changeset 2d16fc7

Timestamp:

01/14/19 17:28:00 (21 months ago)

Author:

Shane Alcock <salcock@…>

Branches:

develop

Children:

6b7a958

Parents:

e0d922a

Message:

Make sure we have four bytes of ERF payload before probing contents.

The PPP check in format_erf is pretty hax as it is, but we should
at least make sure there is enough data there for our probe to be
looking at legit payload, not just some random memory.

File:

• lib/format_erf.c (modified) (1 diff)

lib/format_erf.c

@@ -802 +802 @@
         }
         else {
+                if (trace_get_capture_length(packet) < 5 ||
+                                packet->payload == NULL) {
+                        return ~0;
+                }
+
                 /* Sigh, lets start wildly guessing */
                 if (((char*)packet->payload)[4]==0x45)