diff options
author | Jeff Morriss <jeff.morriss@ulticom.com> | 2012-03-26 22:11:15 +0000 |
---|---|---|
committer | Jeff Morriss <jeff.morriss@ulticom.com> | 2012-03-26 22:11:15 +0000 |
commit | fdb0862c6f11545b8d4ac695f8e6213df7ac72d0 (patch) | |
tree | d313427f622e8df2cb1487c7626bbe6eeff7e4d4 | |
parent | 2256fabd866299b046143b58fa9c7a0e5cc47d62 (diff) |
Fix CID 1336 (new with r40139): infinite loop if length is equal to 1.
svn path=/trunk/; revision=41780
-rw-r--r-- | epan/dissectors/packet-isis-lsp.c | 6 |
1 files changed, 1 insertions, 5 deletions
diff --git a/epan/dissectors/packet-isis-lsp.c b/epan/dissectors/packet-isis-lsp.c index cdb778814f..6dc70c1053 100644 --- a/epan/dissectors/packet-isis-lsp.c +++ b/epan/dissectors/packet-isis-lsp.c @@ -994,10 +994,7 @@ dissect_isis_rt_capable_clv(tvbuff_t *tvb, offset = offset + 5; while (length>1) { - /* length can only be a multiple of 2, otherwise there is - something broken -> so decode down until length is 1 */ - if (length!=1) { - /* fetch two bytes */ + /* fetch two bytes */ rt_block = tvb_get_ntohs(tvb, offset); /* Mask out the lower 8 bits */ @@ -1276,7 +1273,6 @@ dissect_isis_rt_capable_clv(tvbuff_t *tvb, offset = offset+1+(tvb_get_guint8(tvb, offset)); break; } - } } } |