Missing verification on the range for the user-controlled 'len_field' (0, but must be at least 1) results in a wrong value, which becomes a wrong argument for the subtraction ‘-‘ operator in 'len_field-1'. The result is -1 and the sign is flipped; as 'body_len' is unsigned integer, the ‘=’ operator coerces the passed-out result to a distorted value (UINT_MAX), which when used to allocate memory on the heap leads to memory overflow. If exploited, this can lead to denial of service – assertion failure and application exit.

//generated// Missing Code to Verify length (0, but must be at least 1) via Range (len_field must be at least 1) of Stored in Codebase (wireshark-1.8.0/epan/dissectors/packet-dvbci.c#L4044) Local leads to Wrong Value (’len_field’) , which propagates to Wrong Argument (in ‘*body_len = len_field-1;’) Operator Calculate (subtraction ‘-’) Bound (to body_len) Numeric (0) Primitive (guint32) Codebase (wireshark-1.8.0/epan/dissectors/packet-dvbci.c #L4044) in Local that results in Flipped Sign (as ‘(len_field-1)’ is -1,) , which propagates to Flipped Sign (in ‘*body_len = len_field-1;’,, where body_len is guint32, but is being assigned -1,) Pass Out Coerce (assignment ‘=’ operator) Bound (to body_len) Numeric (-1) Primitive Codebase (wireshark-1.8.0/epan/dissectors/packet-dvbci.c #L4044) in Local that results in Distorted Value (‘UINT_MAX’ (large positive integer)) , which propagates to Wrong Size (in ‘fd->data = g_malloc(fd->len);’ (‘fd->len’ set from ‘frag_data_len’ set from ‘body_len’)) Explicit Allocate (g_malloc()) Actual Userland in that results in Memory Overflow , which can be exploited toward Denial of Service (DOS) (availability loss) security failure.