Ethereal-dev: Re: [ethereal-dev] packet-netbios bug

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Gilbert Ramirez <gram@xxxxxxxxxx>
Date: Tue, 24 Aug 1999 17:31:53 -0500
On Tue, Aug 24, 1999 at 04:51:05PM -0500, Guy Harris wrote:
> 
> but, as "nb_name_type_max" is the number of elements in the array, it's
> not the maximum value for "name_type", it's one *more* than the maximum
> value - indices go from 0 to "nb_name_type_max - 1" - so either
> "nb_name_type_max" should be set to
> 
>         (sizeof(name_type_str) /sizeof( char*)) - 1

Okay, I changed it. As you might have noticed, that trace file
causes ethereal to loop tightly. In packet-cdp.c, there's a while()
loop that increments the data pointer by 'length', which is a variable
read from the trace. For a particular packet, length is 0, and
the data pointer is not incremented, causing an infinite loop.

I don't know anything about CDP; if it's a malformed packet that's
causing this infinite loop, it makes me realize that we more places
in ethereal that rely on a value from the packet to increment
the data pointer. We're going to have to check the increment value
in the while loop and if the increment value would cause an infinite
loop, we'll have to abort the processing of that packet.

--gilbert