diff options
| author | Pascal Quantin <pascal.quantin@gmail.com> | 2015-02-10 13:49:28 +0100 |
|---|---|---|
| committer | Pascal Quantin <pascal.quantin@gmail.com> | 2015-02-10 14:02:20 +0000 |
| commit | e915db7cc8c779368afef51c12241337b4d7beda (patch) | |
| tree | 0cf7356cb71db4ba4ed95448bc5113a2aabd6682 /epan/dissectors/packet-multipart.c | |
| parent | 7369c25ad41ef075688420f53f353e8e6c4ddfdb (diff) | |
Do not iterate over reported length when using tvb_find_line_end
if captured length < reported length, this will trigger an infinite loop
Change-Id: I6557b455e7bbff12658a934e5bb13a42c023e133
Reviewed-on: https://code.wireshark.org/review/7053
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Diffstat (limited to 'epan/dissectors/packet-multipart.c')
| -rw-r--r-- | epan/dissectors/packet-multipart.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/epan/dissectors/packet-multipart.c b/epan/dissectors/packet-multipart.c index bd3a0f22cc..4e90e454a0 100644 --- a/epan/dissectors/packet-multipart.c +++ b/epan/dissectors/packet-multipart.c @@ -454,7 +454,7 @@ find_first_boundary(tvbuff_t *tvb, gint start, const guint8 *boundary, { gint offset = start, next_offset, line_len, boundary_start; - while (tvb_reported_length_remaining(tvb, offset + 2 + boundary_len) > 0) { + while (tvb_offset_exists(tvb, offset + 2 + boundary_len)) { boundary_start = offset; if (((tvb_strneql(tvb, offset, (const guint8 *)"--", 2) == 0) && (tvb_strneql(tvb, offset + 2, boundary, boundary_len) == 0))) @@ -500,7 +500,7 @@ find_next_boundary(tvbuff_t *tvb, gint start, const guint8 *boundary, { gint offset = start, next_offset, line_len, boundary_start; - while (tvb_reported_length_remaining(tvb, offset + 2 + boundary_len) > 0) { + while (tvb_offset_exists(tvb, offset + 2 + boundary_len)) { line_len = tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE); if (line_len == -1) { return -1; |