Merge pull request #603 from NickSampanis/603

Fix nbns arbitary length heap overflow
Ettercap · Dec 16, 2014 · f6e452e · f6e452e
2 parents 6a3fc7f + 3f0c582
commit f6e452e
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/plug-ins/nbns_spoof/nbns_spoof.c b/plug-ins/nbns_spoof/nbns_spoof.c
@@ -390,6 +390,10 @@ static void nbns_spoof(struct packet_object *po)
 
 	SAFE_CALLOC(response, NBNS_MSGLEN_QUERY_RESPONSE, sizeof(u_char));
 
+   if (po->DATA.len > 70) {
+       SAFE_FREE(response);
+       return;
+   }
 	memset(response, 0, NBNS_MSGLEN_QUERY_RESPONSE);
 
 	memcpy(response, po->DATA.data, po->DATA.len);