fixed stack smashing cased by wrong block.lenght
@@ -5161,7 +5161,7 @@ process80211packet(tv_sec, tv_usec, caplen, packet_ptr);
return;
}
/*===========================================================================*/
-bool pcapngoptionwalk(int fd, uint32_t tl)
+bool pcapngoptionwalk(int fd, int tl)
{
int resseek;
uint16_t res;
@@ -5179,6 +5179,7 @@ char *gpsd_alt = "alt:";
uint8_t filereplaycound[8];
uint8_t filenonce[32];
+
while(1)
{
res = read(fd, &opthdr, OH_SIZE);
@@ -5204,7 +5205,7 @@ while(1)
{
return true;
}
- tl -= olpad -2;
+ tl = tl -olpad -2;
if(opthdr.option_length > tl)
{
return false;
@@ -5437,6 +5438,12 @@ while(1)
printf("failed to set file pointer\n");
break;
}
+ if(pcapngbh.total_length > (fdsize -aktseek))
+ {
+ pcapreaderrors++;
+ printf("block length greater than file size\n");
+ break;
+ }
if(pcapngbh.total_length > (SHB_SIZE +BH_SIZE +4))
{
if(pcapngoptionwalk(fd, pcapngbh.total_length) == false)
@@ -5801,7 +5808,6 @@ while(1)
if(pcaprhdr.incl_len < MAXPACPSNAPLEN)
{
res = read(fd, &packet, pcaprhdr.incl_len);
-
if(res != pcaprhdr.incl_len)
{
printf("failed to read packet %lld \n", rawpacketcount);
