rtsp: parse the correct token for the status code

Don't call get_token_len on next_token *and* pass in next_token to store the
subsequent pointer - the token we want to parse is the *current* value of
next_token, not the next next token (which may be beyond the end of the buffer,
if next_token happens to be the *last* token).

Bug: 10381
Change-Id: I9fb27e8bdaf2f9556f61841de30cec04b98ffb96
Reviewed-on: https://code.wireshark.org/review/3663
Reviewed-by: Evan Huus <eapache@gmail.com>

1 files changed, 4 insertions, 4 deletions

diff --git a/epan/dissectors/packet-rtsp.c b/epan/dissectors/packet-rtsp.c
index f177115d91..47da5e971c 100644
--- a/epan/dissectors/packet-rtsp.c
+++ b/epan/dissectors/packet-rtsp.c
@@ -435,7 +435,7 @@ static gboolean
 is_rtsp_request_or_reply(const guchar *line, size_t linelen, rtsp_type_t *type)
 {
     guint         ii;
-    const guchar *next_token;
+    const guchar *token, *next_token;
     int           tokenlen;
     gchar         response_chars[4];
 
@@ -446,12 +446,12 @@ is_rtsp_request_or_reply(const guchar *line, size_t linelen, rtsp_type_t *type)
          */
         *type = RTSP_REPLY;
         /* The first token is the version. */
-        tokenlen = get_token_len(line, line+5, &next_token);
+        tokenlen = get_token_len(line, line+5, &token);
         if (tokenlen != 0) {
             /* The next token is the status code. */
-            tokenlen = get_token_len(next_token, line+linelen, &next_token);
+            tokenlen = get_token_len(token, line+linelen, &next_token);
             if (tokenlen >= 3) {
-                memcpy(response_chars, next_token, 3);
+                memcpy(response_chars, token, 3);
                 response_chars[3] = '\0';
                 rtsp_stat_info->response_code = (guint)strtoul(response_chars, NULL, 10);
             }