diff options
| author | sake <sake@f5534014-38df-0310-8fa8-9805f1628bb7> | 2007-11-21 20:33:50 +0000 |
|---|---|---|
| committer | sake <sake@f5534014-38df-0310-8fa8-9805f1628bb7> | 2007-11-21 20:33:50 +0000 |
| commit | ecf28cd20c13e68ae4987250b06fbd54408602ad (patch) | |
| tree | bff6bdae8f03747c2d268b3ce52c67fe23ddf68a /epan/dissectors/packet-cfm.c | |
| parent | 9d25f83ef400deb107d861c02535a41c2037bee7 (diff) | |
Bug 1994: From Keith Mercer :
This bugfix is focused only in the Sender ID TLV segment of code. This was to
address the possibility that the Sender ID TLV may not have a Management
Address Domain, and/or a Management Address. This bug was discovered when
testing the dissector using CFM-enabled Netopia modems.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@23534 f5534014-38df-0310-8fa8-9805f1628bb7
Diffstat (limited to 'epan/dissectors/packet-cfm.c')
| -rw-r--r-- | epan/dissectors/packet-cfm.c | 43 |
1 files changed, 26 insertions, 17 deletions
diff --git a/epan/dissectors/packet-cfm.c b/epan/dissectors/packet-cfm.c index 6885db3f5e..a27ecef898 100644 --- a/epan/dissectors/packet-cfm.c +++ b/epan/dissectors/packet-cfm.c @@ -1624,24 +1624,33 @@ static void dissect_cfm(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) tlv_data_offset += tlv_chassis_id_length; } - proto_tree_add_item(cfm_tlv_tree, hf_tlv_ma_domain_length, - tvb, tlv_data_offset, 1, FALSE); - tlv_ma_domain_length = tvb_get_guint8(tvb,tlv_data_offset); - tlv_data_offset += 1; - if (tlv_ma_domain_length > 0) { - proto_tree_add_item(cfm_tlv_tree, hf_tlv_ma_domain, + /* If the TLV length is greater than the number of octets used for the + * Chassis ID, then we must have a Management Address Domain */ + if (cfm_tlv_length > (2 + tlv_chassis_id_length)) { + proto_tree_add_item(cfm_tlv_tree, hf_tlv_ma_domain_length, + tvb, tlv_data_offset, 1, FALSE); + tlv_ma_domain_length = tvb_get_guint8(tvb,tlv_data_offset); + tlv_data_offset += 1; + if (tlv_ma_domain_length > 0) { + proto_tree_add_item(cfm_tlv_tree, hf_tlv_ma_domain, tvb, tlv_data_offset, tlv_ma_domain_length, FALSE); - tlv_data_offset += tlv_ma_domain_length; - } - - proto_tree_add_item(cfm_tlv_tree, hf_tlv_management_addr_length, - tvb, tlv_data_offset, 1, FALSE); - tlv_management_addr_length = tvb_get_guint8(tvb,tlv_data_offset); - tlv_data_offset += 1; - if (tlv_management_addr_length > 0) { - proto_tree_add_item(cfm_tlv_tree, hf_tlv_management_addr, - tvb, tlv_data_offset, tlv_management_addr_length, FALSE); - tlv_data_offset += tlv_management_addr_length; + tlv_data_offset += tlv_ma_domain_length; + } + + /* If the TLV length is greater than the number of octets used for the + * Chassis ID and the Management Address Domain, then we must have a + * Management Address */ + if (cfm_tlv_length > (2 + tlv_chassis_id_length + 1 + tlv_ma_domain_length)) { + proto_tree_add_item(cfm_tlv_tree, hf_tlv_management_addr_length, + tvb, tlv_data_offset, 1, FALSE); + tlv_management_addr_length = tvb_get_guint8(tvb,tlv_data_offset); + tlv_data_offset += 1; + if (tlv_management_addr_length > 0) { + proto_tree_add_item(cfm_tlv_tree, hf_tlv_management_addr, + tvb, tlv_data_offset, tlv_management_addr_length, FALSE); + tlv_data_offset += tlv_management_addr_length; + } + } } break; case PORT_STAT_TLV: |