diff options
author | Guy Harris <guy@alum.mit.edu> | 2012-12-23 10:51:34 +0000 |
---|---|---|
committer | Guy Harris <guy@alum.mit.edu> | 2012-12-23 10:51:34 +0000 |
commit | 04a5398ab7830cdd75b8832e9d3942c5e1615aa2 (patch) | |
tree | 11f6adef4698fb16a7cebd313689c5ea0c7f93db /epan/dissectors/packet-nlsp.c | |
parent | 74f668444ec5b30a8efd1c514c0bd8646378f011 (diff) |
In nlsp_dissect_clvs(), count len down at the same time we increment the
offset, and do the bounds checking on the length before we count len
down.
svn path=/trunk/; revision=46718
Diffstat (limited to 'epan/dissectors/packet-nlsp.c')
-rw-r--r-- | epan/dissectors/packet-nlsp.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/epan/dissectors/packet-nlsp.c b/epan/dissectors/packet-nlsp.c index 5e9f8cdd72..7184cea06c 100644 --- a/epan/dissectors/packet-nlsp.c +++ b/epan/dissectors/packet-nlsp.c @@ -191,21 +191,20 @@ nlsp_dissect_clvs(tvbuff_t *tvb, proto_tree *tree, int offset, int q; proto_item *ti; proto_tree *clv_tree; - int adj; while ( len > 0 ) { code = tvb_get_guint8(tvb, offset); offset += 1; + len -= 1; length = tvb_get_guint8(tvb, offset); offset += 1; + len -= 1; - adj = (sizeof(code) + sizeof(length) + length); - len -= adj; - if ( len < 0 ) { + if ( len < length ) { nlsp_dissect_unknown(tvb, tree, offset, "Short CLV header (%d vs %d)", - adj, len + adj ); + length, len ); return; } q = 0; @@ -243,6 +242,7 @@ nlsp_dissect_clvs(tvbuff_t *tvb, proto_tree *tree, int offset, } } offset += length; + len -= length; } } |