Avoid absurdly large values used in for-loops.

svn path=/trunk/; revision=37842

1 files changed, 15 insertions, 0 deletions

diff --git a/epan/dissectors/packet-rpcap.c b/epan/dissectors/packet-rpcap.c
index 0596e0a574..aafd074647 100644
--- a/epan/dissectors/packet-rpcap.c
+++ b/epan/dissectors/packet-rpcap.c
@@ -428,6 +428,11 @@ dissect_rpcap_findalldevs_if (tvbuff_t *tvb, packet_info *pinfo _U_,
 
   for (i = 0; i < naddr; i++) {
     offset = dissect_rpcap_findalldevs_ifaddr (tvb, pinfo, tree, offset);
+    if (tvb_length_remaining (tvb, offset) <= 0) {
+      /* No more data in packet */
+      expert_add_info_format (pinfo, ti, PI_MALFORMED, PI_ERROR, "No more data in packet");
+      break;
+    }
   }
 
   proto_item_set_len (ti, offset - boffset);
@@ -449,6 +454,11 @@ dissect_rpcap_findalldevs_reply (tvbuff_t *tvb, packet_info *pinfo _U_,
 
   for (i = 0; i < no_devs; i++) {
     offset = dissect_rpcap_findalldevs_if (tvb, pinfo, tree, offset);
+    if (tvb_length_remaining (tvb, offset) <= 0) {
+      /* No more data in packet */
+      expert_add_info_format (pinfo, ti, PI_MALFORMED, PI_ERROR, "No more data in packet");
+      break;
+    }
   }
 
   proto_item_append_text (ti, ", %d item%s", no_devs, plurality (no_devs, "", "s"));
@@ -504,6 +514,11 @@ dissect_rpcap_filter (tvbuff_t *tvb, packet_info *pinfo,
 
   for (i = 0; i < nitems; i++) {
     offset = dissect_rpcap_filterbpf_insn (tvb, pinfo, tree, offset);
+    if (tvb_length_remaining (tvb, offset) <= 0) {
+      /* No more data in packet */
+      expert_add_info_format (pinfo, ti, PI_MALFORMED, PI_ERROR, "No more data in packet");
+      break;
+    }
   }
 }