Skip to content

Commit 8d546b1

Browse files
committed
Fix vuln crash-7d18f37e1f05e0ff4aa4dfa2f67dd738340ad9cf
1 parent f81ced2 commit 8d546b1

File tree

1 file changed

+12
-1
lines changed

1 file changed

+12
-1
lines changed

3rdParty/LightPcapNg/LightPcapNg/src/light_pcapng.c

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,13 +49,24 @@ static struct _light_option *__parse_options(uint32_t **memory, const int32_t ma
4949
opt->custom_option_code = *local_memory++;
5050
opt->option_length = *local_memory++;
5151

52+
// Validate option_length
53+
if (opt->option_length > max_len - 2 * sizeof(*local_memory)) {
54+
free(opt);
55+
return NULL;
56+
}
57+
5258
actual_length = (opt->option_length % alignment) == 0 ?
5359
opt->option_length :
5460
(opt->option_length / alignment + 1) * alignment;
5561

5662
if (actual_length > 0) {
5763
opt->data = calloc(1, actual_length);
58-
memcpy(opt->data, local_memory, actual_length);
64+
if (actual_length <= max_len - 2 * sizeof(*local_memory)) {
65+
memcpy(opt->data, local_memory, actual_length);
66+
} else {
67+
free(opt->data);
68+
opt->data = NULL;
69+
}
5970
local_memory += (sizeof(**memory) / sizeof(*local_memory)) * (actual_length / alignment);
6071
}
6172

0 commit comments

Comments
 (0)