DICOM dissector needs to check for packet offset overflow
This issue was migrated from bug 14742 in our old bug tracker.
Original bug information:
Reporter: Buildbot Builder
Status: RESOLVED FIXED
Product: Wireshark
Component: Dissection engine (libwireshark)
OS: All
Platform: All
Version: unspecified
See also: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14341
Activity
Problems have been found with the following capture file: https://www.wireshark.org/download/automated/captures/fuzz-2018-05-25-8928.pcap stderr: Input file: /home/wireshark/menagerie/menagerie/16116-ossfuzz_5e1da59148b7de73714ddbcbaaf4e08b79f7f475_dicom_inifite.pcap Build host information: Linux wsbb04 4.4.0-127-generic #153-Ubuntu SMP Sat May 19 10:58:46 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux Distributor ID: Ubuntu Description: Ubuntu 16.04.4 LTS Release: 16.04 Codename: xenial Buildbot information: BUILDBOT_REPOSITORY=ssh://wireshark-buildbot@code.wireshark.org:29418/wireshark BUILDBOT_WORKERNAME=fuzz-test BUILDBOT_BUILDNUMBER=51 BUILDBOT_URL=http://buildbot.wireshark.org/wireshark-2.6/ BUILDBOT_BUILDERNAME=Fuzz Test BUILDBOT_GOT_REVISION=01232935a476e1b37a09e676c4338429c12c72b0 Return value: 0 Dissector bug: 0 Valgrind error count: 0 Git commit commit 01232935a476e1b37a09e676c4338429c12c72b0 Author: Stig Bjørlykke <stig@bjorlykke.org> Date: Thu May 24 21:02:26 2018 +0200 media_type: Default decode application/octet-stream as data Remove registering media_type application/octet-stream from both thread and uasip because the settings will interfere each other. Enable decoding as for media_type instead. Bug: 14729 Change-Id: I58c527977fe4713418219fc3126ce7a93c4bb641 Reviewed-on: https://code.wireshark.org/review/27789 Reviewed-by: Guy Harris <guy@alum.mit.edu> (cherry picked from commit 0362891ecfaba58b1e82fe9e5c579396f81c28bb) Reviewed-on: https://code.wireshark.org/review/27798 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com> ** (process:11461): ERROR **: More than 1000000 items in the tree -- possible infinite loop [ no debug trace ]added libwireshark label
-
Change 27853 had a related patch set uploaded by Guy Harris: Make sure the offset doesn't overflow.
-
Change 27853 merged by Guy Harris: Make sure the offset doesn't overflow.
-
Change 27854 had a related patch set uploaded by Guy Harris: Make sure the offset doesn't overflow.
-
Change 27854 merged by Guy Harris: Make sure the offset doesn't overflow.
-
Change 27855 had a related patch set uploaded by Guy Harris: Make sure the offset doesn't overflow.
-
Change 27855 merged by Guy Harris: Make sure the offset doesn't overflow.
-
Change 27856 had a related patch set uploaded by Guy Harris: Make sure the offset doesn't overflow.
-
Change 27856 merged by Guy Harris: Make sure the offset doesn't overflow.
-
*** Bug #14756 (closed) has been marked as a duplicate of this bug. ***
-
*** Bug #14752 (closed) has been marked as a duplicate of this bug. ***
-
*** Bug #14749 (closed) has been marked as a duplicate of this bug. ***
-
*** Bug #14743 (closed) has been marked as a duplicate of this bug. ***
-
*** Bug #14758 (closed) has been marked as a duplicate of this bug. ***
mentioned in issue #14743 (closed)
mentioned in issue #14749 (closed)
mentioned in issue #14752 (closed)
mentioned in issue #14756 (closed)
mentioned in issue #14758 (closed)