diff options
| author | Stig Bjørlykke <stig@bjorlykke.org> | 2007-08-16 20:54:43 +0000 |
|---|---|---|
| committer | Stig Bjørlykke <stig@bjorlykke.org> | 2007-08-16 20:54:43 +0000 |
| commit | 1ac635cd7dcbbe6f35f5632c6a0a58026ba6d017 (patch) | |
| tree | 90388070b29fca676e9e474caa4270deed28d512 | |
| parent | 8d76d4130ed28a96e25eb9058a3ac6e0814457cb (diff) | |
When calculating checksum for p_mul the checksum field itself is set to zero.
Ensure this field is inside the buffer before altering it, so we don't
write outside the allocated buffer.
svn path=/trunk/; revision=22529
| -rw-r--r-- | epan/dissectors/packet-p_mul.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/epan/dissectors/packet-p_mul.c b/epan/dissectors/packet-p_mul.c index 14d07119e9..57e596db81 100644 --- a/epan/dissectors/packet-p_mul.c +++ b/epan/dissectors/packet-p_mul.c @@ -185,6 +185,11 @@ static guint16 checksum (guint8 *buffer, gint len, gint offset) gint16 cs; guint8 *hpp, *pls; + if (len < offset+2) { + /* Buffer to small */ + return 0; + } + buffer[offset] = 0; buffer[offset+1] = 0; ctmp = len - offset - 1; @@ -331,11 +336,11 @@ static void dissect_p_mul (tvbuff_t *tvb, packet_info *pinfo _U_, offset += 2; /* Checksum */ + en = proto_tree_add_item (p_mul_tree, hf_checksum, tvb, offset, 2, FALSE); len = tvb_length (tvb); value = tvb_get_ephemeral_string (tvb, 0, len); checksum1 = checksum (value, len, offset); checksum2 = tvb_get_ntohs (tvb, offset); - en = proto_tree_add_item (p_mul_tree, hf_checksum, tvb, offset, 2, FALSE); if (checksum1 == checksum2) { proto_item_append_text (en, " (correct)"); } else { |