diff options
| author | Evan Huus <eapache@gmail.com> | 2014-07-03 11:23:04 -0400 |
|---|---|---|
| committer | Evan Huus <eapache@gmail.com> | 2014-07-04 02:21:48 +0000 |
| commit | 746441504973c67d3a2a9cc78c7042993662b8cd (patch) | |
| tree | bdda256de80cf7b9d9ade39c5714fce94050aac3 /epan/dissectors/packet-rtcp.c | |
| parent | bbb3e2f7af074ca92eb0da9e438d919b251ed07e (diff) | |
Fix infinite loop in RTCP dissector
Bug: 10248
Change-Id: I630bc1ab2520c2861b817ba5813f5f7680e96056
Reviewed-on: https://code.wireshark.org/review/2820
Reviewed-by: Evan Huus <eapache@gmail.com>
Diffstat (limited to 'epan/dissectors/packet-rtcp.c')
| -rw-r--r-- | epan/dissectors/packet-rtcp.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/epan/dissectors/packet-rtcp.c b/epan/dissectors/packet-rtcp.c index 31ac17bcfc..29dda871aa 100644 --- a/epan/dissectors/packet-rtcp.c +++ b/epan/dissectors/packet-rtcp.c @@ -2740,6 +2740,9 @@ dissect_rtcp_profile_specific_extensions (packet_info *pinfo, tvbuff_t *tvb, pro { extension_type = tvb_get_ntohs (tvb, offset); extension_length = tvb_get_ntohs (tvb, offset+2); + if (extension_length < 4) { + extension_length = 4; /* expert info? */ + } pse_item = proto_tree_add_text(tree, tvb, offset, extension_length, "Payload Specific Extension"); pse_tree = proto_item_add_subtree( pse_item, ett_pse); |