aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGerald Combs <gerald@wireshark.org>2005-04-18 16:29:54 +0000
committerGerald Combs <gerald@wireshark.org>2005-04-18 16:29:54 +0000
commit8e0186b2da66be0b950631940dfa9fc35a5f8632 (patch)
tree17a8b4376cecdaa3254e2a9a81b6f25e470b3bfd
parent7a412fadf3338974c9e3257a97e68af806628fae (diff)
Detect an infinite loop in dissect_rsvp_ero_rro_subobjects(). Fixes bug 71.
svn path=/trunk/; revision=14128
-rw-r--r--epan/dissectors/packet-rsvp.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/epan/dissectors/packet-rsvp.c b/epan/dissectors/packet-rsvp.c
index 46a1cf9688..59753a61ea 100644
--- a/epan/dissectors/packet-rsvp.c
+++ b/epan/dissectors/packet-rsvp.c
@@ -3330,6 +3330,8 @@ dissect_rsvp_ero_rro_subobjects (proto_tree *ti, proto_tree *rsvp_object_tree,
}
+ if(tvb_get_guint8(tvb, offset+l+1) == 0)
+ THROW(ReportedBoundsError);
l += tvb_get_guint8(tvb, offset+l+1);
if (l < obj_length - 4) {
if (i < 4)