From Johannes Lange:

Function dissect_per_bit_string_display might read more bytes than available (PER dissector).
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5394

svn path=/trunk/; revision=35023

1 files changed, 29 insertions, 11 deletions

diff --git a/epan/dissectors/packet-per.c b/epan/dissectors/packet-per.c
index 9c4a120098..59c431d63a 100644
--- a/epan/dissectors/packet-per.c
+++ b/epan/dissectors/packet-per.c
@@ -2063,17 +2063,35 @@ static tvbuff_t *dissect_per_bit_string_display(tvbuff_t *tvb, guint32 offset, a
 				proto_item_append_text(actx->created_item, ", %u LSB pad bits", pad_length);
 			}
 		}
-		
-		if (length<=64) {
-			if (length<=8)
-				value = tvb_get_bits8(tvb, offset, length);
-			else if (length<=16)
-				value = tvb_get_bits16(tvb, offset, length, FALSE);
-			else if (length<=32)
-				value = tvb_get_bits32(tvb, offset, length, FALSE);
-			else
-				value = tvb_get_bits64(tvb, offset, length, FALSE);
-			
+		 
+		if (length<=64) { /* if read into 64 bits also handle length <= 24, 40, 48, 56 bits */
+			if (length<=8) {
+				value = tvb_get_bits8(out_tvb, 0, length);
+			}else if (length<=16) {
+				value = tvb_get_bits16(out_tvb, 0, length, FALSE);
+			}else if (length<=24) { /* first read 16 and then the remaining bits */
+				value = tvb_get_bits16(out_tvb, 0, 16, FALSE);
+				value <<= 8;
+				value |= tvb_get_bits8(out_tvb, 16, length - 16);
+			}else if (length<=32) {
+				value = tvb_get_bits32(out_tvb, 0, length, FALSE);
+			}else if (length<=40) { /* first read 32 and then the remaining bits */
+				value = tvb_get_bits32(out_tvb, 0, 32, FALSE);
+				value <<= 8;
+				value |= tvb_get_bits8(out_tvb, 32, length - 32);
+			}else if (length<=48) { /* first read 32 and then the remaining bits */
+				value = tvb_get_bits32(out_tvb, 0, 32, FALSE);
+				value <<= 16;
+				value |= tvb_get_bits16(out_tvb, 32, length - 32, FALSE);
+			}else if (length<=56) { /* first read 32 and 16 then the remaining bits */
+				value = tvb_get_bits32(out_tvb, 0, 32, FALSE);
+				value <<= 16;
+				value |= tvb_get_bits16(out_tvb, 32, 16, FALSE);
+				value <<= 8;
+				value |= tvb_get_bits8(out_tvb, 48, length - 48);
+			}else {
+				value = tvb_get_bits64(out_tvb, 0, length, FALSE);
+			}
 			if (actx->aligned){
 				proto_item_append_text(actx->created_item, ", %s decimal value %" G_GINT64_MODIFIER "u", 
 					decode_bits_in_field(pad_length, length, value), value);