diff options
| author | Peter Wu <peter@lekensteyn.nl> | 2016-02-20 15:06:50 +0100 |
|---|---|---|
| committer | Peter Wu <peter@lekensteyn.nl> | 2016-02-20 15:06:45 +0000 |
| commit | 55b5b7caf3ec4856838b0416d5a91d3a3ff67ec8 (patch) | |
| tree | e58335d1ff0b9a5d49f03f5c04dd57967d1713dd /epan/dissectors/packet-ber.c | |
| parent | c31425f9ae15067e26ccc6183c206c34713cb256 (diff) | |
ber: fix buffer overrun when handling empty sets
When a set is empty, only a terminator (ber_sequence_t with NULL func)
is present. In that case, do not try to find more values as that will
never succeed.
Bug: 12106
Change-Id: I26cd4ba84a9580e92d5921592a27c2af17c0bebf
Reviewed-on: https://code.wireshark.org/review/14028
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Diffstat (limited to 'epan/dissectors/packet-ber.c')
| -rw-r--r-- | epan/dissectors/packet-ber.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/epan/dissectors/packet-ber.c b/epan/dissectors/packet-ber.c index 9bbf3ffc55..81e4d38feb 100644 --- a/epan/dissectors/packet-ber.c +++ b/epan/dissectors/packet-ber.c @@ -2594,6 +2594,10 @@ printf("SET dissect_ber_set(%s) entered\n", name); cset = set; /* reset to the beginning */ set_idx = 0; + /* If the set has no values, there is no point in trying again. */ + if (!cset->func) { + break; + } } if ((first_pass && ((cset->ber_class == ber_class) && (cset->tag == tag))) || |