francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
52 lines
2.0 KiB
Diff
52 lines
2.0 KiB
Diff
From aba1fbe6266beb6bf9b887b6eab008e4f4841c9b Mon Sep 17 00:00:00 2001
|
|
From: AndersBroman <a.broman58@gmail.com>
|
|
Date: Mon, 1 Dec 2025 08:41:55 +0100
|
|
Subject: MEGACO: Handle tvb_get_uint8 returning -1
|
|
|
|
When dissecting a media descriptor, handle tvb_get_uint8 returning
|
|
-1 when searching for a left or right bracket and not finding it
|
|
by setting the bracket offset to the end offset so that the loop
|
|
will exit. Leaving it at -1 can cause going backwards and at worst
|
|
infinite loops.
|
|
|
|
Fix #20884
|
|
|
|
(cherry picked from commit aba1fbe6266beb6bf9b887b6eab008e4f4841c9b)
|
|
|
|
Co-authored-by: John Thacker <johnthacker@gmail.com>
|
|
origin: https://gitlab.com/wireshark/wireshark/-/merge_requests/22553
|
|
|
|
|
|
CVE: CVE-2025-13946
|
|
Upstream-Status: Backport [https://gitlab.com/wireshark/wireshark/-/commit/aba1fbe6266beb6bf9b887b6eab008e4f4841c9b]
|
|
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
|
---
|
|
epan/dissectors/packet-megaco.c | 11 +++++++++--
|
|
1 file changed, 9 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/epan/dissectors/packet-megaco.c b/epan/dissectors/packet-megaco.c
|
|
index 327b849..abf2078 100644
|
|
--- a/epan/dissectors/packet-megaco.c
|
|
+++ b/epan/dissectors/packet-megaco.c
|
|
@@ -1775,8 +1775,15 @@ dissect_megaco_mediadescriptor(tvbuff_t *tvb, proto_tree *megaco_tree_command_li
|
|
mediaParm = find_megaco_mediaParm_names(tvb, tvb_current_offset, tokenlen);
|
|
|
|
tvb_LBRKT = tvb_find_guint8(tvb, tvb_next_offset , tvb_last_RBRKT, '{');
|
|
- tvb_next_offset = tvb_find_guint8(tvb, tvb_current_offset+1 , tvb_last_RBRKT, '}');
|
|
- tvb_RBRKT = tvb_next_offset;
|
|
+ if (tvb_LBRKT == -1) {
|
|
+ // Not found, use the end offset.
|
|
+ tvb_LBRKT = tvb_last_RBRKT;
|
|
+ }
|
|
+ tvb_RBRKT = tvb_find_guint8(tvb, tvb_current_offset+1 , tvb_last_RBRKT, '}');
|
|
+ if (tvb_RBRKT == -1) {
|
|
+ // Not found, use the end offset.
|
|
+ tvb_RBRKT = tvb_last_RBRKT;
|
|
+ }
|
|
|
|
switch ( mediaParm ){
|
|
case MEGACO_LOCAL_TOKEN:
|
|
--
|
|
2.50.1
|
|
|