wireshark/wireshark-0010-CVE-2024-8250.patch
2024-09-27 12:34:07 +02:00

50 lines
1.7 KiB
Diff

From 66dcd56f1eae615697b6588ac4778a61a5576391 Mon Sep 17 00:00:00 2001
From: John Thacker <johnthacker@gmail.com>
Date: Sun, 28 Jul 2024 08:24:20 -0400
Subject: [PATCH] ntlmssp: Don't insert a key created on the stack into a hash
table
We could change this table to an autoreset wmem_map as well.
Fix #19943
---
epan/dissectors/packet-ntlmssp.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/epan/dissectors/packet-ntlmssp.c b/epan/dissectors/packet-ntlmssp.c
index 7e1d754ee35..ff825ddee55 100644
--- a/epan/dissectors/packet-ntlmssp.c
+++ b/epan/dissectors/packet-ntlmssp.c
@@ -2438,7 +2438,9 @@ decrypt_data_payload(tvbuff_t *tvb, int offset, uint32_t encrypted_block_length,
decrypted_payloads = g_slist_prepend(decrypted_payloads,
packet_ntlmssp_info->decrypted_payload);
if (key != NULL) {
- g_hash_table_insert(hash_packet, key, packet_ntlmssp_info);
+ uint8_t *perm_key = g_new(uint8_t, NTLMSSP_KEY_LEN);
+ memcpy(perm_key, key, NTLMSSP_KEY_LEN);
+ g_hash_table_insert(hash_packet, perm_key, packet_ntlmssp_info);
}
/* Do the decryption of the payload */
@@ -2888,7 +2890,7 @@ header_hash(const void *pointer)
static gboolean
header_equal(gconstpointer pointer1, gconstpointer pointer2)
{
- if (!memcmp(pointer1, pointer2, 16)) {
+ if (!memcmp(pointer1, pointer2, NTLMSSP_KEY_LEN)) {
return TRUE;
}
else {
@@ -2899,7 +2901,7 @@ header_equal(const void *pointer1, const void *pointer2)
static void
ntlmssp_init_protocol(void)
{
- hash_packet = g_hash_table_new(header_hash, header_equal);
+ hash_packet = g_hash_table_new_full(header_hash, header_equal, g_free, NULL);
}
static void
--
GitLab