diff options
| author | Guy Harris <guy@alum.mit.edu> | 2011-08-13 22:33:14 +0000 |
|---|---|---|
| committer | Guy Harris <guy@alum.mit.edu> | 2011-08-13 22:33:14 +0000 |
| commit | c6eb12cc5feadc4fbf9e646d9b4cf88b075d76a6 (patch) | |
| tree | 4b4e5055ddaa7d7a0c501697673b6f320462d33e /epan/dissectors/packet-coap.c | |
| parent | b3862dec4d34913b0662ea64104d4f73c9ee9722 (diff) | |
Do more checking of the TLV length. Yes, the length can be zero or
negative in a malformed packet. Should fix bug 6238.
svn path=/trunk/; revision=38521
Diffstat (limited to 'epan/dissectors/packet-coap.c')
| -rw-r--r-- | epan/dissectors/packet-coap.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/epan/dissectors/packet-coap.c b/epan/dissectors/packet-coap.c index 830234c126..07a461d024 100644 --- a/epan/dissectors/packet-coap.c +++ b/epan/dissectors/packet-coap.c @@ -256,7 +256,7 @@ dissect_coap_opt_time(tvbuff_t *tvb, packet_info *pinfo, proto_tree *subtree, gi { proto_item *item = NULL; - if (opt_length > 4) { + if (opt_length <= 0 || opt_length > 4) { expert_add_info_format(pinfo, subtree, PI_MALFORMED, PI_WARN, "Invalid Option Length: %d", opt_length); return; } |