diff options
| author | Anders Broman <anders.broman@ericsson.com> | 2012-04-17 21:09:10 +0000 |
|---|---|---|
| committer | Anders Broman <anders.broman@ericsson.com> | 2012-04-17 21:09:10 +0000 |
| commit | cc650868af02cf1b45a263f1d8d3ddb14dbf68eb (patch) | |
| tree | 3f2aefac25ab658d02d7020c7d1941338bb4ab01 /epan/dissectors/packet-bthci_evt.c | |
| parent | dc49bf04c0193a9b0a14a50e36fe3d8720fe6510 (diff) | |
From Evan Huus: We were using guint8s as loop counters based on field lengths, and they were overflowing/wrapping falsely. Making them guint16s fixes the problem. Bug 7122 -HCIEVT infinite loop https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7122
svn path=/trunk/; revision=42114
Diffstat (limited to 'epan/dissectors/packet-bthci_evt.c')
| -rw-r--r-- | epan/dissectors/packet-bthci_evt.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/epan/dissectors/packet-bthci_evt.c b/epan/dissectors/packet-bthci_evt.c index 1c25280922..3f0b7b4ed6 100644 --- a/epan/dissectors/packet-bthci_evt.c +++ b/epan/dissectors/packet-bthci_evt.c @@ -1269,7 +1269,8 @@ dissect_bthci_evt_inq_result_with_rssi(tvbuff_t *tvb, int offset, packet_info *p static int dissect_bthci_evt_ext_inquiry_response(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree) { - guint8 i, j, length, type; + guint8 length, type; + guint16 i, j; proto_item *ti_eir = NULL; proto_item *ti_eir_subtree = NULL; |