Actions
Bug #3593
closedStack overflow when parsing ERF file
Affected Versions:
Effort:
Difficulty:
low
Label:
Description
Despite the low possibility of potential threat. The unchecked rlen in ReadErfRecord function will cause a stack overflow when the value assigned is below sizeof(DagRecord).
int rlen = SCNtohs(dr.rlen);
int wlen = SCNtohs(dr.wlen);
r = fread(GET_PKT_DATA(p), rlen - sizeof(DagRecord), 1, etv->erf);
if (r < 1) {
Files
Actions