Avoid endless loop in the rsvp dissector which allowed a remote DoS.

Bump package revision because of this change.

1 files changed, 130 insertions, 0 deletions

diff --git a/net/ethereal/patches/patch-aa b/net/ethereal/patches/patch-aa
new file mode 100644
index 00000000000..7aae28a2805
--- /dev/null
+++ b/net/ethereal/patches/patch-aa
@@ -0,0 +1,130 @@
+$NetBSD: patch-aa,v 1.13 2005/04/28 16:46:45 tron Exp $
+
+--- epan/dissectors/packet-rsvp.c.orig	2005-03-10 15:53:40.000000000 +0000
++++ epan/dissectors/packet-rsvp.c	2005-04-28 16:56:00.000000000 +0100
+@@ -1346,9 +1346,9 @@
+ 		       tvbuff_t *tvb, int offset, int obj_length, 
+ 		       int subtree_type)
+ {
+-    guint16   tlv_off;
++    guint     tlv_off;
+     guint16   tlv_type;
+-    guint16   tlv_len;
++    guint     tlv_len;
+     char     *ifindex_name;
+     proto_tree *rsvp_ifid_subtree, *ti2;
+     int       offset2 = offset + 4;
+@@ -1356,6 +1356,12 @@
+     for (tlv_off = 0; tlv_off < obj_length - 12; ) {
+ 	tlv_type = tvb_get_ntohs(tvb, offset+tlv_off);
+ 	tlv_len = tvb_get_ntohs(tvb, offset+tlv_off+2);
++
++	if (tlv_len == 0) {
++	    proto_tree_add_text(rsvp_object_tree, tvb, offset+tlv_off+2, 2,
++		"Invalid length (0)");
++	    return;
++	}
+ 	switch(tlv_type) {
+ 	case 1:
+ 	    ti2 = proto_tree_add_text(rsvp_object_tree, tvb,
+@@ -3330,6 +3336,11 @@
+ 
+ 	}
+ 
++	if (tvb_get_guint8(tvb, offset+l+1) < 1) {
++	    proto_tree_add_text(rsvp_ro_subtree, tvb, offset+l+1, 1,
++		"Invalid length: %u", tvb_get_guint8(tvb, offset+l+1));
++	    return;
++	}
+ 	l += tvb_get_guint8(tvb, offset+l+1);
+ 	if (l < obj_length - 4) {
+ 	    if (i < 4)
+@@ -4020,6 +4031,11 @@
+ 	    }
+ 
+ 	    l += tvb_get_guint8(tvb, offset2+l+1);
++	    if (l < 1) {
++		proto_tree_add_text(rsvp_gen_uni_subtree, tvb, offset2+l+1, 1,
++		    "Invalid length: %u", tvb_get_guint8(tvb, offset2+l+1));
++		return;
++	    }
+ 	    if (l < mylen) {
+ 		if (i < 4)
+ 		    proto_item_append_text(ti, ", ");
+@@ -4070,7 +4086,7 @@
+     proto_tree_add_text(rsvp_object_tree, tvb, offset+2, 1,
+ 			"Class number: %u - %s",
+ 			class, type_str);
+-    proto_item_set_text(ti, "CALL-ID");
++    proto_item_set_text(ti, "CALL-ID: ");
+     type = tvb_get_guint8 (tvb, offset2);
+     switch(c_type) {
+     case 1:
+@@ -4084,6 +4100,8 @@
+ 			      val_to_str(type, address_type_vals, "Unknown (%u)"));
+ 	  proto_tree_add_text(rsvp_object_tree, tvb, offset2+1, 3, "Reserved: %u",
+ 			      tvb_get_ntoh24(tvb, offset2+1));
++	  proto_item_append_text(ti, "Operator-Specific. Addr Type: %s. ", 
++				 val_to_str(type, address_type_vals, "Unknown (%u)"));
+ 	}
+ 	else {
+ 	  offset3 = offset2 + 16;
+@@ -4095,10 +4113,13 @@
+ 	  str = tvb_get_string (tvb, offset2 + 1, 3);  
+ 	  proto_tree_add_text(rsvp_object_tree, tvb, offset2 + 1, 3,
+ 			      "International Segment: %s", str); 
++	  proto_item_append_text(ti, "Globally-Unique. Addr Type: %s. Intl Segment: %s. ", 
++				 val_to_str(type, address_type_vals, "Unknown (%u)"), str);
+ 	  g_free (str);
+ 	  str = tvb_get_string (tvb, offset2 + 4, 12);  
+ 	  proto_tree_add_text(rsvp_object_tree, tvb, offset2 + 4, 12,
+ 			      "National Segment: %s", str); 
++	  proto_item_append_text(ti, "Natl Segment: %s. ", str);
+ 	  g_free (str);
+ 	}
+ 
+@@ -4107,30 +4128,36 @@
+ 	  offset4 = offset3 + 4;
+ 	  proto_tree_add_text(rsvp_object_tree, tvb, offset3, 4, "Source Transport Network addr: %s",
+ 			      ip_to_str(tvb_get_ptr(tvb, offset3, 4)));
++	  proto_item_append_text(ti, "Src TNA: %s. ", ip_to_str(tvb_get_ptr(tvb, offset3, 4)));
+ 	  break;
+ 	  
+ 	case 2:
+ 	  offset4 = offset3 + 16;
+ 	  proto_tree_add_text(rsvp_object_tree, tvb, offset3, 16, "Source Transport Network addr: %s",
+ 			      ip6_to_str((const struct e_in6_addr *) tvb_get_ptr(tvb, offset3, 16)));
++	  proto_item_append_text(ti, "Src TNA: %s. ", 
++				 ip6_to_str((const struct e_in6_addr *) tvb_get_ptr(tvb, offset3, 16)));
+ 	  break;
+ 	  
+ 	case 3:
+ 	  offset4 = offset3 + 20;
+ 	  proto_tree_add_text(rsvp_object_tree, tvb, offset3, 20, "Source Transport Network addr: %s",
+ 			      tvb_bytes_to_str(tvb, offset3, 20));
++	  proto_item_append_text(ti, "Src TNA: %s. ", tvb_bytes_to_str(tvb, offset3, 20));
+ 	  break;
+ 	  
+ 	case 4:
+ 	  offset4 = offset3 + 6;
+ 	  proto_tree_add_text(rsvp_object_tree, tvb, offset3, 6, "Source Transport Network addr: %s",
+ 			      tvb_bytes_to_str(tvb, offset3, 6));
++	  proto_item_append_text(ti, "Src TNA: %s. ", tvb_bytes_to_str(tvb, offset3, 6));
+ 	  break;
+ 	  
+ 	case 0x7F:
+ 	  offset4 = offset3 + len;
+ 	  proto_tree_add_text(rsvp_object_tree, tvb, offset3, len, "Source Transport Network addr: %s",
+ 			      tvb_bytes_to_str(tvb, offset3, len));
++	  proto_item_append_text(ti, "Src TNA: %s. ", tvb_bytes_to_str(tvb, offset3, len));
+ 	  break;
+ 
+ 	default:
+@@ -4141,6 +4168,7 @@
+ 
+ 	proto_tree_add_text(rsvp_object_tree, tvb, offset4, 8, "Local Identifier: %s",
+ 			    tvb_bytes_to_str(tvb, offset4, 8));
++	proto_item_append_text(ti, "Local ID: %s. ", tvb_bytes_to_str(tvb, offset4, 8));
+ 	break;
+ 
+     default: