diff options
| author | Gerald Combs <gerald@wireshark.org> | 2005-09-19 20:50:10 +0000 |
|---|---|---|
| committer | Gerald Combs <gerald@wireshark.org> | 2005-09-19 20:50:10 +0000 |
| commit | bb45165680c355a73acb4af8d02e8942d22df819 (patch) | |
| tree | 2c654dcc99c7cc4bae7af1e698ff25f54cabf390 | |
| parent | 9597f669bde5051f0e5c99dfedb41c74943ebf24 (diff) | |
Throw an exception instead of trying to read past the end of a buffer.
Fixes bug 455.
svn path=/trunk/; revision=15876
| -rw-r--r-- | epan/sigcomp-udvm.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/epan/sigcomp-udvm.c b/epan/sigcomp-udvm.c index 0074bc1bdb..53b6c7ae7b 100644 --- a/epan/sigcomp-udvm.c +++ b/epan/sigcomp-udvm.c @@ -45,6 +45,7 @@ #include "sigcomp_state_hdlr.h" #include "sha1.h" #include "crc16.h" +#include "except.h" #define SIGCOMP_INSTR_DECOMPRESSION_FAILURE 0 #define SIGCOMP_INSTR_AND 1 @@ -877,6 +878,8 @@ execute_next_instruction: handle_now = byte_copy_right - position; } + if (k + handle_now >= UDVM_MEMORY_SIZE) + THROW(ReportedBoundsError); sha1_update( &ctx, &buff[k], handle_now ); k = ( k + handle_now ) & 0xffff; @@ -1789,6 +1792,8 @@ execute_next_instruction: handle_now = byte_copy_right - k; } + if (k + handle_now >= UDVM_MEMORY_SIZE) + THROW(ReportedBoundsError); result = crc16_ccitt_seed(&buff[k], handle_now, result ^ 0xffff); k = ( k + handle_now ) & 0xffff; |