diff options
| author | Michele Campus <fci1908@gmail.com> | 2016-04-12 23:41:02 +0200 |
|---|---|---|
| committer | Michele Campus <fci1908@gmail.com> | 2016-04-12 23:41:02 +0200 |
| commit | da811fbdd0023a0a3dc3f810029ef92e83e1f781 (patch) | |
| tree | 5e75a520f4c2f12ab85b22914f15c8f0857f132e /src/lib/protocols/h323.c | |
| parent | 885cc3864eccaa0eaadff7233f5a6a94c4239e24 (diff) | |
| parent | d7a2515093ce64d29020c0768956c6ead1ae23da (diff) | |
Merge pull request #173 from theirix/buffer-overflows
Fixed multiple buffer overflows
Diffstat (limited to 'src/lib/protocols/h323.c')
| -rw-r--r-- | src/lib/protocols/h323.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/src/lib/protocols/h323.c b/src/lib/protocols/h323.c index 1d503a747..7a94dabd5 100644 --- a/src/lib/protocols/h323.c +++ b/src/lib/protocols/h323.c @@ -27,7 +27,8 @@ void ndpi_search_h323(struct ndpi_detection_module_struct *ndpi_struct, struct n NDPI_LOG(NDPI_PROTOCOL_H323, ndpi_struct, NDPI_LOG_DEBUG, "calculated dport over tcp.\n"); /* H323 */ - if((packet->payload[0] == 0x03) + if(packet->payload_packet_len >= 3 + && (packet->payload[0] == 0x03) && (packet->payload[1] == 0x00) && (packet->payload[2] == 0x00)) { struct tpkt *t = (struct tpkt*)packet->payload; @@ -63,7 +64,8 @@ void ndpi_search_h323(struct ndpi_detection_module_struct *ndpi_struct, struct n sport = ntohs(packet->udp->source), dport = ntohs(packet->udp->dest); NDPI_LOG(NDPI_PROTOCOL_H323, ndpi_struct, NDPI_LOG_DEBUG, "calculated dport over udp.\n"); - if(packet->payload[0] == 0x80 && packet->payload[1] == 0x08 && (packet->payload[2] == 0xe7 || packet->payload[2] == 0x26) && + if(packet->payload_packet_len >= 5 && packet->payload[0] == 0x80 && packet->payload[1] == 0x08 && + (packet->payload[2] == 0xe7 || packet->payload[2] == 0x26) && packet->payload[4] == 0x00 && packet->payload[5] == 0x00) { NDPI_LOG(NDPI_PROTOCOL_H323, ndpi_struct, NDPI_LOG_DEBUG, "found H323 broadcast.\n"); |