diff options
| author | etxrab <etxrab@f5534014-38df-0310-8fa8-9805f1628bb7> | 2011-11-10 06:07:16 +0000 |
|---|---|---|
| committer | etxrab <etxrab@f5534014-38df-0310-8fa8-9805f1628bb7> | 2011-11-10 06:07:16 +0000 |
| commit | 77c5bbfa2b445d78e83dd8f1b53eb0c06d81de44 (patch) | |
| tree | b40b739960c6de1915c3e68f5c742c65c939f684 /epan/dissectors/packet-capwap.c | |
| parent | 22983dead950e36623d0eadf9e4b94c0aca1a7fc (diff) | |
From Dirk:
CAPWAP dissector tries to allocate -1 bytes of memory during reassembly.
- changed to return offset.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@39779 f5534014-38df-0310-8fa8-9805f1628bb7
Diffstat (limited to 'epan/dissectors/packet-capwap.c')
| -rw-r--r-- | epan/dissectors/packet-capwap.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/epan/dissectors/packet-capwap.c b/epan/dissectors/packet-capwap.c index a56075c07c..2f2f908d8e 100644 --- a/epan/dissectors/packet-capwap.c +++ b/epan/dissectors/packet-capwap.c @@ -1374,13 +1374,17 @@ dissect_capwap_control(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) if (global_capwap_reassemble && fragment_is) { + const int len_rem = tvb_length_remaining(tvb, offset); + if (len_rem <= 0) + return offset; + pinfo->fragmented = TRUE; frag_msg = fragment_add_check(tvb, offset, pinfo,fragment_id, capwap_fragment_table, capwap_reassembled_table, fragment_offset, - tvb_length_remaining(tvb, offset), + len_rem, fragment_more); next_tvb = process_reassembled_data(tvb, offset, pinfo, |