diff options
| author | Graeme Lunt <graeme.lunt@smhs.co.uk> | 2011-09-25 07:02:57 +0000 |
|---|---|---|
| committer | Graeme Lunt <graeme.lunt@smhs.co.uk> | 2011-09-25 07:02:57 +0000 |
| commit | 0cdfb11c2ff1027cd8e585689329cf4415df3bad (patch) | |
| tree | 7f8acd8d3db84c6efed4cbce67b767518e0ba380 /epan/dissectors/packet-rdp.c | |
| parent | d8849821385282695399a1577483a594b59f43ce (diff) | |
Bug 6369:
Unprotected array write.
svn path=/trunk/; revision=39125
Diffstat (limited to 'epan/dissectors/packet-rdp.c')
| -rw-r--r-- | epan/dissectors/packet-rdp.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/epan/dissectors/packet-rdp.c b/epan/dissectors/packet-rdp.c index 040b930576..935b88ee9e 100644 --- a/epan/dissectors/packet-rdp.c +++ b/epan/dissectors/packet-rdp.c @@ -1910,7 +1910,8 @@ dissect_rdp_ServerData(tvbuff_t *tvb _U_, packet_info *pinfo _U_, proto_tree *tr for(i = 0; i < channelCount; i++) { offset = dissect_rdp_fields(tvb, offset, pinfo, next_tree, channel_fields); if(rdp_info) { - rdp_info->channels[i].value = channelId; + if(i < MAX_CHANNELS) + rdp_info->channels[i].value = channelId; /* register SendData on this for now */ register_t124_sd_dissector(pinfo, channelId, dissect_rdp_SendData, proto_rdp); |