From Florent DROUIN:

There is a new check for the length, and the reported_length is added to the
offset, instead of the "theorical" length of the element.

This fixes bug 2052.

svn path=/trunk/; revision=23687

1 files changed, 8 insertions, 3 deletions

diff --git a/epan/dissectors/packet-rpl.c b/epan/dissectors/packet-rpl.c
index 59d84ed822..60d0de16e3 100644
--- a/epan/dissectors/packet-rpl.c
+++ b/epan/dissectors/packet-rpl.c
@@ -148,11 +148,16 @@ dissect_rpl_container(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 				reported_length = tvb_reported_length_remaining(tvb, offset);
 				if (reported_length > sublen)
 					reported_length = sublen;
-				dissect_rpl_container(tvb_new_subset(tvb, 
+				if ( length > 0) {
+				  dissect_rpl_container(tvb_new_subset(tvb, 
 					offset, length, reported_length),
 					pinfo, rpl_container_tree);
-
-				offset += sublen;
+				  offset += reported_length;
+				} else {
+				  /* no more data, exit the loop */
+				  offset += reported_length;
+				  break;
+				}
 			}	
 			break;