diff options
| author | Gerald Combs <gerald@wireshark.org> | 2005-06-15 20:55:11 +0000 |
|---|---|---|
| committer | Gerald Combs <gerald@wireshark.org> | 2005-06-15 20:55:11 +0000 |
| commit | a9f65e1cf3c2fac755002a0bca95c9be66ce4047 (patch) | |
| tree | cb07bb7e7b326ed9fb504abf739e33b0cb8ab557 /epan/dissectors/packet-dcerpc-samr.c | |
| parent | 86fc5a99b2c983d8829d8ee3034b442426623a8d (diff) | |
In sam_dissect_SAM_SECURITY_DESCRIPTOR_data(), throw an exception if we
fetch a too-long length. Fixes bug 236.
svn path=/trunk/; revision=14637
Diffstat (limited to 'epan/dissectors/packet-dcerpc-samr.c')
| -rw-r--r-- | epan/dissectors/packet-dcerpc-samr.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/epan/dissectors/packet-dcerpc-samr.c b/epan/dissectors/packet-dcerpc-samr.c index 33eb02ae1f..17d63cd2cc 100644 --- a/epan/dissectors/packet-dcerpc-samr.c +++ b/epan/dissectors/packet-dcerpc-samr.c @@ -250,6 +250,7 @@ sam_dissect_SAM_SECURITY_DESCRIPTOR_data(tvbuff_t *tvb, int offset, { guint32 len; dcerpc_info *di; + int old_offset = offset; di=pinfo->private_data; if(di->conformant_run){ @@ -264,6 +265,8 @@ sam_dissect_SAM_SECURITY_DESCRIPTOR_data(tvbuff_t *tvb, int offset, tvb, offset, pinfo, tree, drep, len, &samr_connect_access_mask_info); offset += len; + if (offset < old_offset) + THROW(ReportedBoundsError); return offset; } |