diff options
| author | Gerald Combs <gerald@wireshark.org> | 2005-03-28 15:55:47 +0000 |
|---|---|---|
| committer | Gerald Combs <gerald@wireshark.org> | 2005-03-28 15:55:47 +0000 |
| commit | 131ab36a3257aec679019b7877fcf5055f9e3bca (patch) | |
| tree | 566af01360ddc5c0ebc696f2f8f1b08b8fdeaec2 /epan/dissectors/packet-aim.c | |
| parent | 9d6ac60cefff17895674beaf30447b7a2c9285fc (diff) | |
In tvb_get_string(), throw an exception if our length is less than zero.
Add a message block length check to the AIM dissector.
svn path=/trunk/; revision=13955
Diffstat (limited to 'epan/dissectors/packet-aim.c')
| -rw-r--r-- | epan/dissectors/packet-aim.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/epan/dissectors/packet-aim.c b/epan/dissectors/packet-aim.c index 528cac50ba..6bc69b7336 100644 --- a/epan/dissectors/packet-aim.c +++ b/epan/dissectors/packet-aim.c @@ -1189,6 +1189,11 @@ int dissect_aim_tlv_value_messageblock (proto_item *ti, guint16 valueid _U_, tvb /* Block length (includes charset and charsubset) */ blocklen = tvb_get_ntohs(tvb, offset); + if (blocklen <= 4) { + proto_tree_add_text(entry, tvb, offset, 2, "Invalid block length: %d", + blocklen); + break; + } proto_tree_add_item(entry, hf_aim_messageblock_len, tvb, offset, 2, FALSE); offset += 2; |