Add missing check for a too-large packet, so we don't blow up trying to

allocate a huge buffer; fixes bug 6667.

svn path=/trunk/; revision=40166

1 files changed, 10 insertions, 0 deletions

diff --git a/wiretap/i4btrace.c b/wiretap/i4btrace.c
index e4155b5e6b..ac2336ce40 100644
--- a/wiretap/i4btrace.c
+++ b/wiretap/i4btrace.c
@@ -145,6 +145,16 @@ static gboolean i4btrace_read(wtap *wth, int *err, gchar **err_info,
 		return FALSE;
 	}
 	length = hdr.length - (guint32)sizeof(hdr);
+	if (length > WTAP_MAX_PACKET_SIZE) {
+		/*
+		 * Probably a corrupt capture file; don't blow up trying
+		 * to allocate space for an immensely-large packet.
+		 */
+		*err = WTAP_ERR_BAD_RECORD;
+		*err_info = g_strdup_printf("i4btrace: File has %u-byte packet, bigger than maximum of %u",
+		    length, WTAP_MAX_PACKET_SIZE);
+		return FALSE;
+	}
 
 	wth->phdr.len = length;
 	wth->phdr.caplen = length;