Skip to content
  • Jim Borden's avatar
    BLIP: Fix decompression buffer bug · 4a948427
    Jim Borden authored and A Wireshark GitLab Utility's avatar A Wireshark GitLab Utility committed
    Until now, mistakenly, the buffer for decompressing compressed BLIP messages
    has been statically allocated as 16 Kb, but that is not valid behavior.
    16 Kb is the maximum size of a _compressed_ frame.  In theory, due to the
    ability to zipbomb, there is virtually no upper bound on what the maximum
    size of an uncompressed frame could be.  However, to keep sanity, it has
    been made into a preference with a reasonable default that is not likely to
    be exceeded (64 Kb).  The behavior before for this was that wireshark would
    crash because the dissector would return NULL for a decompressed buffer due
    to error and then try to deference it later.  A null check has been added,
    so that the behavior is now that the packet will show
    '<Error decompressing message>' instead, and log why it couldn't handle the
    compressed message.  Closes #16866.
    4a948427