diff options
| author | guy <guy@f5534014-38df-0310-8fa8-9805f1628bb7> | 2011-07-09 18:56:21 +0000 |
|---|---|---|
| committer | guy <guy@f5534014-38df-0310-8fa8-9805f1628bb7> | 2011-07-09 18:56:21 +0000 |
| commit | 789438955f6dfa03c2057d81e87be9b8841da290 (patch) | |
| tree | 4045dff360e32b3c71aaf0c2fc9fcca842dcd1d0 /epan/dissectors/packet-x11.c | |
| parent | 7d17b01caea544e848acb057b632b2204a159d81 (diff) | |
If the reply length is < 32, that's an overflow, not a bug in the
dissector (unless you consider the calculation not being done in 64 bits
as a bug). For now, toss a ReportedBoundsError.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@37946 f5534014-38df-0310-8fa8-9805f1628bb7
Diffstat (limited to 'epan/dissectors/packet-x11.c')
| -rw-r--r-- | epan/dissectors/packet-x11.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/epan/dissectors/packet-x11.c b/epan/dissectors/packet-x11.c index 3a22dbd7ee..18f61c4513 100644 --- a/epan/dissectors/packet-x11.c +++ b/epan/dissectors/packet-x11.c @@ -4764,7 +4764,9 @@ dissect_x11_replies(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) /* replylength is in units of four. */ tmp_plen = plen = 32 + VALUE32(tvb, offset + 4) * 4; - DISSECTOR_ASSERT(tmp_plen >= 32); + /* If tmp_plen < 32, we got an overflow; + * the reply length is too long. */ + THROW_ON(tmp_plen < 32, ReportedBoundsError); HANDLE_REPLY(plen, length_remaining, "Reply", dissect_x11_reply); break; |