Ettercap/ettercap — pull request #98 by jacob-baines (2013-03-02 19:29:01+00:00)
Title: Invalid Reads in LDAP

LDAP does a number of pointer manipulations that don't do any length checking. Here is a sample valgrind error:

==6574== Invalid read of size 1
==6574== at 0x807A147: dissector_ldap (ec_ldap.c:73)
==6574== by 0x8059A74: decode_data (ec_decode.c:305)
==6574== by 0x808A538: decode_tcp (ec_tcp.c:294)
==6574== by 0x80889C4: decode_ip (ec_ip.c:224)
==6574== by 0x8087DD6: decode_eth (ec_eth.c:81)
==6574== by 0x805970F: ec_decode (ec_decode.c:186)

I added in a few checks to ensure that this doesn't occur. I tested with http://www.pcapr.net/view/mu/2009/0/2/15/NSS-LDAP-login.cap.html to make sure the username/password still gets pulled out.

This issue can be reproduced with https://www.wireshark.org/download/automated/captures/fuzz-2006-07-05-6279.pcap