diff options
| author | Gerald Combs <gerald@wireshark.org> | 2010-01-29 21:57:32 +0000 |
|---|---|---|
| committer | Gerald Combs <gerald@wireshark.org> | 2010-01-29 21:57:32 +0000 |
| commit | 080bbacb4185c5859049bdfeddc8fcb11de06eed (patch) | |
| tree | 1b67b9f55a64986d76b83c62662be41602aed689 /epan/dissectors/packet-netflow.c | |
| parent | e8e8c37a5f1231caefff14bfc8c03fbcd9022d28 (diff) | |
Preliminary fix for bug 4423.
svn path=/trunk/; revision=31735
Diffstat (limited to 'epan/dissectors/packet-netflow.c')
| -rw-r--r-- | epan/dissectors/packet-netflow.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/epan/dissectors/packet-netflow.c b/epan/dissectors/packet-netflow.c index ca5b07d19f..aca63470ca 100644 --- a/epan/dissectors/packet-netflow.c +++ b/epan/dissectors/packet-netflow.c @@ -3299,7 +3299,7 @@ dissect_v9_options_template(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutr /* Cache template */ memset(&tplt, 0, sizeof(tplt)); tplt.id = id; - tplt.count = flowset_id == 1 ? tplt.count = 0 : option_scope_len - option_len; + tplt.count = flowset_id == 1 ? 0 : option_scope_len - option_len; SE_COPY_ADDRESS(&tplt.source_addr, &hdrinfo->net_src); tplt.source_id = hdrinfo->src_id; /* Option scopes */ @@ -3322,7 +3322,7 @@ dissect_v9_options_template(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutr offset += 2; len += 2; scope_length = tvb_get_ntohs(tvb,offset); - if (tplt.scopes) { + if (tplt.scopes && i < option_scope_len) { tplt.scopes[i].type = type; tplt.scopes[i].length = scope_length == VARIABLE_LENGTH ? 0 : scope_length; tplt.length += tplt.scopes[i].length; @@ -3333,7 +3333,7 @@ dissect_v9_options_template(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutr /* Private Enterprise Number (IPFIX only) */ if ((flowset_id == 3) && (type & 0x8000)) { - if (tplt.scopes) { + if (tplt.scopes && i < option_scope_len) { tplt.scopes[i].pen = tvb_get_ntohl(tvb,offset); } proto_tree_add_item(pdutree, @@ -3360,7 +3360,7 @@ dissect_v9_options_template(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutr entry_length = tvb_get_ntohs(tvb, offset); - if (tplt.entries) { + if (tplt.entries && i < tplt.count) { tplt.entries[i].type = type; tplt.entries[i].length = entry_length == VARIABLE_LENGTH ? 0 : entry_length; tplt.length += tplt.entries[i].length; @@ -3371,7 +3371,7 @@ dissect_v9_options_template(tvbuff_t *tvb, packet_info *pinfo, proto_tree *pdutr /* Private Enterprise Number (IPFIX only) */ if ((flowset_id == 3) && (type & 0x8000)) { - if (tplt.entries) { + if (tplt.entries && i < tplt.count) { tplt.entries[i].pen = tvb_get_ntohl(tvb,offset); } proto_tree_add_item(pdutree, |