diff options
author | Guy Harris <guy@alum.mit.edu> | 2010-02-09 10:17:53 +0000 |
---|---|---|
committer | Guy Harris <guy@alum.mit.edu> | 2010-02-09 10:17:53 +0000 |
commit | 161c33aadb97ad3551850f04128bd8a71aaf8ae5 (patch) | |
tree | 92a6469d8294f168b9846fc71d5b53ba86ed8ab8 /epan/dissectors/packet-sflow.c | |
parent | 07922081ff970ed90ed3272ddf5b1d8dd37486ea (diff) |
Don't trust the length field in a V5 sample to be valid.
This appears to fix bug 4473.
svn path=/trunk/; revision=31846
Diffstat (limited to 'epan/dissectors/packet-sflow.c')
-rw-r--r-- | epan/dissectors/packet-sflow.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/epan/dissectors/packet-sflow.c b/epan/dissectors/packet-sflow.c index 63365e074d..34f4328682 100644 --- a/epan/dissectors/packet-sflow.c +++ b/epan/dissectors/packet-sflow.c @@ -2632,6 +2632,8 @@ dissect_sflow_245_samples(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, g default: break; } + /* Make sure the length doesn't run past the end of the packet */ + tvb_ensure_bytes_exist(tvb, offset, length); /* current offset points to sample length field, which is 4 bytes from the beginning of the packet*/ offset += length; } else { /* unknown enterprise format, what to do?? */ |