In nlsp_dissect_clvs(), count len down at the same time we increment the

offset, and do the bounds checking on the length before we count len
down.

svn path=/trunk/; revision=46718

1 files changed, 5 insertions, 5 deletions

diff --git a/epan/dissectors/packet-nlsp.c b/epan/dissectors/packet-nlsp.c
index 5e9f8cdd72..7184cea06c 100644
--- a/epan/dissectors/packet-nlsp.c
+++ b/epan/dissectors/packet-nlsp.c
@@ -191,21 +191,20 @@ nlsp_dissect_clvs(tvbuff_t *tvb, proto_tree *tree, int offset,
 	int q;
 	proto_item	*ti;
 	proto_tree	*clv_tree;
-	int 		adj;
 
 	while ( len > 0 ) {
 		code = tvb_get_guint8(tvb, offset);
 		offset += 1;
+		len -= 1;
 
 		length = tvb_get_guint8(tvb, offset);
 		offset += 1;
+		len -= 1;
 
-		adj = (sizeof(code) + sizeof(length) + length);
-		len -= adj;
-		if ( len < 0 ) {
+		if ( len < length ) {
 			nlsp_dissect_unknown(tvb, tree, offset,
 				"Short CLV header (%d vs %d)",
-				adj, len + adj );
+				length, len );
 			return;
 		}
 		q = 0;
@@ -243,6 +242,7 @@ nlsp_dissect_clvs(tvbuff_t *tvb, proto_tree *tree, int offset,
 			}
 		}
 		offset += length;
+		len -= length;
 	}
 }