diff options
| author | Martin Kaiser <wireshark@kaiser.cx> | 2015-07-17 19:24:04 +0200 |
|---|---|---|
| committer | Alexis La Goutte <alexis.lagoutte@gmail.com> | 2015-07-19 21:05:13 +0000 |
| commit | 030da2a6118342a77be7d4676d5ddb55f2215dbb (patch) | |
| tree | a3b13e6e59ce7faa18342680cce3851088b5a47b /epan/dissectors/packet-gvsp.c | |
| parent | 21b99e3eced4fc4d016fe1293e44966ebbcbd291 (diff) | |
coverity 1250812: fix a (very unlikely) integer overflow
Change-Id: I151cb2186c7dabbab1bef5cd35dabe19a3600dfd
Reviewed-on: https://code.wireshark.org/review/9703
Petri-Dish: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Diffstat (limited to 'epan/dissectors/packet-gvsp.c')
| -rw-r--r-- | epan/dissectors/packet-gvsp.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/epan/dissectors/packet-gvsp.c b/epan/dissectors/packet-gvsp.c index 8d08010cf9..e68d4182dc 100644 --- a/epan/dissectors/packet-gvsp.c +++ b/epan/dissectors/packet-gvsp.c @@ -689,8 +689,11 @@ static gint dissect_file_leader(proto_tree *gvsp_tree, tvbuff_t *tvb, packet_inf file_length = tvb_strsize(tvb, offset + 20); proto_tree_add_item(gvsp_tree, hf_gvsp_filename, tvb, offset + 20, file_length, ENC_ASCII|ENC_NA); + if (20 + file_length > G_MAXINT) + return -1; + /* Return dissected byte count (for all-in dissection) */ - return 20 + file_length; + return (gint)(20 + file_length); } @@ -1006,6 +1009,8 @@ static void dissect_packet_payload_multizone(proto_tree *gvsp_tree, tvbuff_t *tv static void dissect_packet_all_in(proto_tree *gvsp_tree, tvbuff_t *tvb, gint offset, packet_info *pinfo, gvsp_packet_info *info) { + gint ret; + switch (info->payloadtype) { case GVSP_PAYLOAD_IMAGE: @@ -1029,7 +1034,10 @@ static void dissect_packet_all_in(proto_tree *gvsp_tree, tvbuff_t *tvb, gint off break; case GVSP_PAYLOAD_FILE: - offset += dissect_file_leader(gvsp_tree, tvb, pinfo, offset); + ret = dissect_file_leader(gvsp_tree, tvb, pinfo, offset); + if (ret < 0) + break; + offset += ret; offset += dissect_generic_trailer(gvsp_tree, tvb, pinfo, offset); if (info->chunk != 0) { |