From fdb0862c6f11545b8d4ac695f8e6213df7ac72d0 Mon Sep 17 00:00:00 2001 From: Jeff Morriss Date: Mon, 26 Mar 2012 22:11:15 +0000 Subject: Fix CID 1336 (new with r40139): infinite loop if length is equal to 1. svn path=/trunk/; revision=41780 --- epan/dissectors/packet-isis-lsp.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) (limited to 'epan') diff --git a/epan/dissectors/packet-isis-lsp.c b/epan/dissectors/packet-isis-lsp.c index cdb778814f..6dc70c1053 100644 --- a/epan/dissectors/packet-isis-lsp.c +++ b/epan/dissectors/packet-isis-lsp.c @@ -994,10 +994,7 @@ dissect_isis_rt_capable_clv(tvbuff_t *tvb, offset = offset + 5; while (length>1) { - /* length can only be a multiple of 2, otherwise there is - something broken -> so decode down until length is 1 */ - if (length!=1) { - /* fetch two bytes */ + /* fetch two bytes */ rt_block = tvb_get_ntohs(tvb, offset); /* Mask out the lower 8 bits */ @@ -1276,7 +1273,6 @@ dissect_isis_rt_capable_clv(tvbuff_t *tvb, offset = offset+1+(tvb_get_guint8(tvb, offset)); break; } - } } } -- cgit v1.2.3