From aba1fbe6266beb6bf9b887b6eab008e4f4841c9b Mon Sep 17 00:00:00 2001 From: AndersBroman Date: Mon, 1 Dec 2025 08:41:55 +0100 Subject: MEGACO: Handle tvb_get_uint8 returning -1 When dissecting a media descriptor, handle tvb_get_uint8 returning -1 when searching for a left or right bracket and not finding it by setting the bracket offset to the end offset so that the loop will exit. Leaving it at -1 can cause going backwards and at worst infinite loops. Fix #20884 (cherry picked from commit aba1fbe6266beb6bf9b887b6eab008e4f4841c9b) Co-authored-by: John Thacker origin: https://gitlab.com/wireshark/wireshark/-/merge_requests/22553 CVE: CVE-2025-13946 Upstream-Status: Backport [https://gitlab.com/wireshark/wireshark/-/commit/aba1fbe6266beb6bf9b887b6eab008e4f4841c9b] Signed-off-by: Hitendra Prajapati --- epan/dissectors/packet-megaco.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/epan/dissectors/packet-megaco.c b/epan/dissectors/packet-megaco.c index 327b849..abf2078 100644 --- a/epan/dissectors/packet-megaco.c +++ b/epan/dissectors/packet-megaco.c @@ -1775,8 +1775,15 @@ dissect_megaco_mediadescriptor(tvbuff_t *tvb, proto_tree *megaco_tree_command_li mediaParm = find_megaco_mediaParm_names(tvb, tvb_current_offset, tokenlen); tvb_LBRKT = tvb_find_guint8(tvb, tvb_next_offset , tvb_last_RBRKT, '{'); - tvb_next_offset = tvb_find_guint8(tvb, tvb_current_offset+1 , tvb_last_RBRKT, '}'); - tvb_RBRKT = tvb_next_offset; + if (tvb_LBRKT == -1) { + // Not found, use the end offset. + tvb_LBRKT = tvb_last_RBRKT; + } + tvb_RBRKT = tvb_find_guint8(tvb, tvb_current_offset+1 , tvb_last_RBRKT, '}'); + if (tvb_RBRKT == -1) { + // Not found, use the end offset. + tvb_RBRKT = tvb_last_RBRKT; + } switch ( mediaParm ){ case MEGACO_LOCAL_TOKEN: -- 2.50.1