dnp3: avoids DOS by too long loop over null-sized objects

[people/ms/suricata.git] / scripts / dnp3-gen / dnp3-gen.py

diff --git a/scripts/dnp3-gen/dnp3-gen.py b/scripts/dnp3-gen/dnp3-gen.py
index b2226c3217b89c0001a8e48353051f62ce74af28..447d38638714c5b4ff07359e2f035fe4fee26421 100755 (executable)
--- a/scripts/dnp3-gen/dnp3-gen.py
+++ b/scripts/dnp3-gen/dnp3-gen.py
@@ -432,6 +432,9 @@ static int DNP3DecodeObjectG{{object.group}}V{{object.variation}}(const uint8_t
 {% endfor %}
 {% endif %}
 
+    if (*len < count/8) {
+        goto error;
+    }
     while (count--) {
 
         object = SCCalloc(1, sizeof(*object));