Report an error if the IP total length is bigger than the containing length.

Change-Id: Ib5990fce89304808a585a99164c0176899acbbb7
Reviewed-on: https://code.wireshark.org/review/12667
Reviewed-by: Guy Harris <guy@alum.mit.edu>

1 files changed, 17 insertions, 9 deletions

diff --git a/epan/dissectors/packet-ip.c b/epan/dissectors/packet-ip.c
index 31e8b0a410..139264d59d 100644
--- a/epan/dissectors/packet-ip.c
+++ b/epan/dissectors/packet-ip.c
@@ -2122,15 +2122,23 @@ dissect_ip_v4(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, void*
       return tvb_captured_length(tvb);
     }
   } else {
-    /*
-     * Now that we know that the total length of this IP datagram isn't
-     * obviously bogus, adjust the length of this tvbuff to include only
-     * the IP datagram.
-     */
-    set_actual_length(tvb, iph->ip_len);
-
-    if (tree)
-      proto_tree_add_uint(ip_tree, hf_ip_len, tvb, offset + 2, 2, iph->ip_len);
+    tf = proto_tree_add_uint(ip_tree, hf_ip_len, tvb, offset + 2, 2, iph->ip_len);
+    if (iph->ip_len > tvb_reported_length(tvb)) {
+      /*
+       * Length runs past the data we're given.
+       * Note that.
+       */
+      expert_add_info_format(pinfo, tf, &ei_ip_bogus_ip_length,
+                  "IPv4 total length exceeds packet length (%u bytes)",
+                  tvb_reported_length(tvb));
+    } else {
+      /*
+       * Now that we know that the total length of this IP datagram isn't
+       * obviously bogus, adjust the length of this tvbuff to include only
+       * the IP datagram.
+       */
+      set_actual_length(tvb, iph->ip_len);
+    }
   }
 
   iph->ip_id  = tvb_get_ntohs(tvb, offset + 4);