diff options
| author | Chris Maynard <Christopher.Maynard@GTECH.COM> | 2012-05-24 23:14:30 +0000 |
|---|---|---|
| committer | Chris Maynard <Christopher.Maynard@GTECH.COM> | 2012-05-24 23:14:30 +0000 |
| commit | 06606bb68f3be34ce06ea8876062d19f5fee2efd (patch) | |
| tree | a3825d5614be645f51150a8314c953666f6aa946 /epan/dissectors/packet-gadu-gadu.c | |
| parent | 135ebc4148af774c99dd7c2492925227d2a2cc7a (diff) | |
tvb_reported_length_remaining() can return a negative number. In dissect_gadu_gadu_userlist80_compressed(), bail out if it does. Fixes Coverity CID 703085. In dissect_gadu_gadu_stringz_cp1250(), be sure to compare against its return value as being only positve rather than non-zero. Also, fixed a couple of typos.
svn path=/trunk/; revision=42837
Diffstat (limited to 'epan/dissectors/packet-gadu-gadu.c')
| -rw-r--r-- | epan/dissectors/packet-gadu-gadu.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/epan/dissectors/packet-gadu-gadu.c b/epan/dissectors/packet-gadu-gadu.c index 567387c7f6..4d394867f0 100644 --- a/epan/dissectors/packet-gadu-gadu.c +++ b/epan/dissectors/packet-gadu-gadu.c @@ -316,7 +316,7 @@ static const value_string gadu_gadu_userlist_reply_type_vals[] = { { 0, NULL } }; -/* XXX, add compatilible libgadu versions? */ +/* XXX, add compatible libgadu versions? */ static const value_string gadu_gadu_version_vals[] = { { 0x2e, "Gadu-Gadu 8.0 (build 8283)" }, { 0x2d, "Gadu-Gadu 8.0 (build 4881)" }, @@ -423,7 +423,7 @@ dissect_gadu_gadu_stringz_cp1250(tvbuff_t *tvb, int hfindex, proto_tree *tree, i str = g_string_new(NULL); - while (len && (ch = tvb_get_guint8(tvb, offset))) { + while ((len > 0) && (ch = tvb_get_guint8(tvb, offset))) { if (ch < 0x80) g_string_append_c(str, ch); else @@ -431,7 +431,7 @@ dissect_gadu_gadu_stringz_cp1250(tvbuff_t *tvb, int hfindex, proto_tree *tree, i offset++; len--; } - if (len) + if (len > 0) offset++; /* NUL */ /* proto_item_fill_label() is broken for UTF-8 strings. @@ -1149,8 +1149,11 @@ dissect_gadu_gadu_userlist80_compressed(tvbuff_t *tvb, packet_info *pinfo, proto int remain = tvb_reported_length_remaining(tvb, offset); tvbuff_t *uncomp_tvb; + if (remain <= 0) + return offset; + if ((uncomp_tvb = tvb_child_uncompress(tvb, tvb, offset, remain))) { - proto_tree_add_text(tree, tvb, offset, remain, "Userlist XML data: [Decompression successed]"); + proto_tree_add_text(tree, tvb, offset, remain, "Userlist XML data: [Decompression succeeded]"); add_new_data_source(pinfo, uncomp_tvb, "Uncompressed userlist"); call_dissector_only(xml_handle, uncomp_tvb, pinfo, tree); |