search

sipcapture / hep-wireshark

HOMER HEP Wireshark Dissector
http://sipcapture.org
GNU General Public License v2.0
27 stars 13 forks source link

Lack of boundary checking #9

Open sobomax opened 6 years ago

sobomax commented 6 years ago

Hi, we've tried to use this dissector to debug new implementation of the HEPv3 client, but it seems to be lacking any even basic boundary/sanity checks, causing wireshark to hang solid while dissecting small capture (attached). This severely limits its usefulness for such use cases as well could lead to problems while processing large number of real-world packets, as wire errors do happen in real life.

cap.zip

lmangani commented 6 years ago

Hey @sobomax what version of Wireshark are you using?

sobomax commented 6 years ago

Latest for windows I think. screenshot749

sobomax commented 6 years ago

P.S. I looked at the code briefly and I don't see any validation of the length field(s). Those values just taken verbatim, never compared to the actual packet size. Which is likely to be the cause.

lmangani commented 6 years ago

I agree and that's an excellent observation, we'll do our best to sort this out, just wanted to make sure it was not platform specific - so far personally had no such issues and used it pretty intensively on Linux.