diff options
| author | Gerasimos Dimitriadis <dimeg@intracom.gr> | 2010-02-22 00:04:51 +0000 |
|---|---|---|
| committer | Gerasimos Dimitriadis <dimeg@intracom.gr> | 2010-02-22 00:04:51 +0000 |
| commit | c79b4e547367cccb283d6d1fc125c9225e3d89cc (patch) | |
| tree | 2a592c1ab7962254ef73fe1bdc5892fc22577278 /epan/dissectors/packet-ltp.c | |
| parent | 5ebfb767a66681338105434ce0a35dc6c885493e (diff) | |
Fix for bug 4509:
Make sure that the length addition results have not wrapped.
svn path=/trunk/; revision=31945
Diffstat (limited to 'epan/dissectors/packet-ltp.c')
| -rw-r--r-- | epan/dissectors/packet-ltp.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/epan/dissectors/packet-ltp.c b/epan/dissectors/packet-ltp.c index 76ec1f21d3..b6c1bd4d77 100644 --- a/epan/dissectors/packet-ltp.c +++ b/epan/dissectors/packet-ltp.c @@ -275,7 +275,16 @@ dissect_data_segment(proto_tree *ltp_tree, tvbuff_t *tvb,packet_info *pinfo,int } } /* Adding size of the data */ + if ((segment_offset + (int)length < segment_offset) || (segment_offset + (int)length < (int)length)) { + /* Addition result has wrapped */ + return 0; + } segment_offset+= (int)length; + + if ((segment_offset + frame_offset < segment_offset) || (segment_offset + frame_offset < frame_offset)) { + /* Addition result has wrapped */ + return 0; + } if((unsigned)(frame_offset + segment_offset) > tvb_length(tvb)){ /* This would mean the data segment is incomplete */ return 0; |