diff options
author | gerald <gerald@f5534014-38df-0310-8fa8-9805f1628bb7> | 2004-12-06 23:12:32 +0000 |
---|---|---|
committer | gerald <gerald@f5534014-38df-0310-8fa8-9805f1628bb7> | 2004-12-06 23:12:32 +0000 |
commit | 5eed5cb27133d3174a31b1a561d69353d1645a67 (patch) | |
tree | 38e27c284f206fb3cfee761f3f50039c60b242a4 /epan/dissectors/packet-ppp.c | |
parent | 1e7945212a0b631f02cb195a182f65bfb06f8c83 (diff) |
Add more suboption length checks to dissect_bap_phone_delta_opt().
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@12672 f5534014-38df-0310-8fa8-9805f1628bb7
Diffstat (limited to 'epan/dissectors/packet-ppp.c')
-rw-r--r-- | epan/dissectors/packet-ppp.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/epan/dissectors/packet-ppp.c b/epan/dissectors/packet-ppp.c index 7cedbd1aca..25a34e3db6 100644 --- a/epan/dissectors/packet-ppp.c +++ b/epan/dissectors/packet-ppp.c @@ -2459,6 +2459,11 @@ dissect_bap_phone_delta_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, "Sub-Option (%d byte%s)", subopt_len, plurality(subopt_len, "", "s")); suboption_tree = proto_item_add_subtree(ti, ett_bap_phone_delta_subopt); + if (subopt_len < 1) { + proto_tree_add_text(suboption_tree, tvb, offset + 1, 1, + "Invalid suboption length: %u", subopt_len); + return; + } proto_tree_add_text(suboption_tree, tvb, offset, 1, "Sub-Option Type: %s (%u)", @@ -2488,11 +2493,19 @@ dissect_bap_phone_delta_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, proto_tree_add_text(suboption_tree, tvb, offset + 2, subopt_len - 2, "Phone Number Sub Address: %s", tvb_format_text(tvb, offset + 2, subopt_len - 2)); + } else { + proto_tree_add_text(suboption_tree, tvb, offset + 1, 1, + "Invalid suboption length: %u", subopt_len); } break; default: - proto_tree_add_text(suboption_tree, tvb, offset + 2, subopt_len - 2, + if (subopt_len > 2) { + proto_tree_add_text(suboption_tree, tvb, offset + 2, subopt_len - 2, "Unknown"); + } else { + proto_tree_add_text(suboption_tree, tvb, offset + 1, 1, + "Invalid suboption length: %u", subopt_len); + } break; } offset += subopt_len; |