Ethereal-dev: Re: [ethereal-dev] Patch for OSPF MD5 decode.

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Gilbert Ramirez <gram@xxxxxxxxxx>
Date: Tue, 19 Oct 1999 08:28:40 -0500
On Tue, Oct 19, 1999 at 12:22:07PM +0000, Tony Hart wrote:
> 
> >     char auth_data[(2 * 16) + 1]="";
> 118a121
> >                  crypto = (e_ospf_crypto *)ospfh.auth_data;
> 120c123,133

> > 		 ospflen = ntohs(ospfh.length);
> > 		 for (i = 0; i < crypto->length; i++)
> > 		     sprintf(&auth_data[i*2],"%02x",pd[offset + ospflen + i]);

The only thing I suggest is to check the sanity of crypto->length
before using it in the loop. It seems that you're using crypto->length
directly from the packet; if that packet is corrupt and you get a really
large value for crypto->length, you'll end up copying past the bounds
of auth_data[].

--gilbert