diff options
| author | Gerald Combs <gerald@wireshark.org> | 2005-09-07 15:40:59 +0000 |
|---|---|---|
| committer | Gerald Combs <gerald@wireshark.org> | 2005-09-07 15:40:59 +0000 |
| commit | a151e8cc6afe0bf60c61cfca08cd3fe0508a2e4d (patch) | |
| tree | 6457eebf11d863d0ac0a6f158c1dd6f5bd840a89 | |
| parent | a33ff649dfe1ab24f3a8c77bec4d650ff7d661ba (diff) | |
If dissect_ber_octet_string() gives us a null tvb, assume we have a malformed
packet and throw an exception. Don't pass the null tvb to tvb_length().
svn path=/trunk/; revision=15713
| -rw-r--r-- | epan/dissectors/packet-ber.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/epan/dissectors/packet-ber.c b/epan/dissectors/packet-ber.c index d2723e25ce..60cab55928 100644 --- a/epan/dissectors/packet-ber.c +++ b/epan/dissectors/packet-ber.c @@ -519,6 +519,11 @@ reassemble_octet_string(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset = dissect_ber_octet_string(FALSE, pinfo, tree, tvb, offset, hf_ber_unknown_OCTETSTRING, &next_tvb); + if (next_tvb == NULL) { + /* Assume that we have a malformed packet. */ + THROW(ReportedBoundsError); + } + if(ind) { /* this was indefinite length - so check for EOC */ |