diff options
| author | Bill Meier <wmeier@newsguy.com> | 2010-06-13 13:58:02 +0000 |
|---|---|---|
| committer | Bill Meier <wmeier@newsguy.com> | 2010-06-13 13:58:02 +0000 |
| commit | 897769ca2caef7eb625f3f98fac6469083af3646 (patch) | |
| tree | 9e324faf98fd5bb96b5a8e6207d2afa511d0c68c /epan/dissectors/packet-iax2.c | |
| parent | 2827d00f2ae175e5e6dab86401a20ba85883e97a (diff) | |
Fix Bug #4868; "Wireshark crash selecting Inter-Asterisk exchange v2 packet data"
See: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4868
A field length was being set incorrectly (too large) thus causing
packet_hex_apply_reverse_tag() to run off the end of a text_view buffer
(thus causing a crash) when attempting to highlight the field bytes
in the hex-view pane.
ToDo: Add some sanity checking in packet_hex_apply_reverse_tag().
svn path=/trunk/; revision=33212
Diffstat (limited to 'epan/dissectors/packet-iax2.c')
| -rw-r--r-- | epan/dissectors/packet-iax2.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/epan/dissectors/packet-iax2.c b/epan/dissectors/packet-iax2.c index 8cb7497469..1c41bfd3bb 100644 --- a/epan/dissectors/packet-iax2.c +++ b/epan/dissectors/packet-iax2.c @@ -1410,7 +1410,7 @@ static guint32 dissect_iax2_command(tvbuff_t * tvb, guint32 offset, if (offset >= tvb_reported_length (tvb)) return offset; - offset += dissect_ies(tvb, offset, tree, &ie_data); + offset = dissect_ies(tvb, offset, tree, &ie_data); /* if this is a data call, set up a subdissector for the circuit */ if(iax_call && ie_data.dataformat != (guint32)-1 && iax_call -> subdissector == NULL) { |