diff options
| author | Gerald Combs <gerald@wireshark.org> | 2004-12-01 20:51:19 +0000 |
|---|---|---|
| committer | Gerald Combs <gerald@wireshark.org> | 2004-12-01 20:51:19 +0000 |
| commit | c12298c6684fe55cb69279db90a7f4d82f34182b (patch) | |
| tree | 6326598a784364a6c084f3580446e74cf1a98697 /epan/dissectors/packet-tds.c | |
| parent | df3a7623c982be88397b3d9a352cb56c68e58a7f (diff) | |
Catch a couple of integer overflows.
svn path=/trunk/; revision=12641
Diffstat (limited to 'epan/dissectors/packet-tds.c')
| -rw-r--r-- | epan/dissectors/packet-tds.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/epan/dissectors/packet-tds.c b/epan/dissectors/packet-tds.c index 565b10073b..f9636881e1 100644 --- a/epan/dissectors/packet-tds.c +++ b/epan/dissectors/packet-tds.c @@ -1476,6 +1476,16 @@ dissect_tds_resp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) length_remaining = tvb_ensure_length_remaining(tvb, pos); + if ((int) token_sz < 0) { + proto_tree_add_text(tree, tvb, pos, 0, "Bogus token size: %u", + token_sz); + break; + } + if ((int) token_len_field_size < 0) { + proto_tree_add_text(tree, tvb, pos, 0, "Bogus token length field size: %u", + token_len_field_size); + break; + } token_item = proto_tree_add_text(tree, tvb, pos, token_sz, "Token 0x%02x %s", token, val_to_str(token, token_names, "Unknown Token Type")); |