Update a comment - a bad packet size could also be the result of a file

not actually being an ERF file.

Don't compute the packet size until you know that rlen is valid.

svn path=/trunk/; revision=29366

1 files changed, 3 insertions, 2 deletions

diff --git a/wiretap/erf.c b/wiretap/erf.c
index 49bdaa9581..6d9a549cd2 100644
--- a/wiretap/erf.c
+++ b/wiretap/erf.c
@@ -126,7 +126,6 @@ extern int erf_open(wtap *wth, int *err, gchar **err_info _U_)
 
     rlen=g_ntohs(header.rlen);
     wlen=g_ntohs(header.wlen);
-    packet_size = rlen - (guint32)sizeof(header);
 
     /* fail on invalid record type, invalid rlen, timestamps decreasing, or incrementing too far */
     
@@ -135,9 +134,11 @@ extern int erf_open(wtap *wth, int *err, gchar **err_info _U_)
       return 0;
     }
     
+    packet_size = rlen - (guint32)sizeof(header);
     if (packet_size > WTAP_MAX_PACKET_SIZE) {
       /*
-       * Probably a corrupt capture file; don't blow up trying
+       * Probably a corrupt capture file or a file that's not an ERF file
+       * but that passed earlier tests; don't blow up trying
        * to allocate space for an immensely-large packet.
        */
       return 0;