diff options
| author | Guy Harris <guy@alum.mit.edu> | 2004-12-22 19:27:09 +0000 |
|---|---|---|
| committer | Guy Harris <guy@alum.mit.edu> | 2004-12-22 19:27:09 +0000 |
| commit | 9e176608c5376f3c9260d9a279f688a41f65751b (patch) | |
| tree | eca81853bf88a5dd917412d51ac7095d402d2e3b /epan/dissectors | |
| parent | e501ee7f01b4913695ac5dcce4423461e01ee926 (diff) | |
RFC 2868 says that the length of a "tagged string" field must be at
least 3 - 2 for type+length and 1 for the tag - so treat a "tagged
string" field as bad if there isn't at least one byte of data. (It's a
bit odd that the RFC says that the tag must be in the range 0x01-0x1F -
that sounds suspiciously as if they're saying "printable characters
aren't valid tags", to allow untagged strings, which might suggest that
a field with a length of 2 should be interpreted as an empty string.)
svn path=/trunk/; revision=12817
Diffstat (limited to 'epan/dissectors')
| -rw-r--r-- | epan/dissectors/packet-radius.c | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/epan/dissectors/packet-radius.c b/epan/dissectors/packet-radius.c index 8edc3c7fc7..788a4cf101 100644 --- a/epan/dissectors/packet-radius.c +++ b/epan/dissectors/packet-radius.c @@ -3706,14 +3706,14 @@ static void rd_value_to_str(gchar *dest, rd_vsa_buffer (*vsabuffer)[VSABUFFER], case( RADIUS_STRING_TAGGED ): /* Tagged ? */ - if (avph->avp_length > 2) { - tag = tvb_get_guint8(tvb,offset+2); - if (tag > 0 && tag <= 0x1f) { - sprintf(dest, "Tag:%u, Value:", tag); - cont=&cont[strlen(cont)]; - rdconvertbufftostr(cont,tvb,offset+3,avph->avp_length-3); - break; - } + if (!avp_length_check(cont, avph, 1)) + return; + tag = tvb_get_guint8(tvb,offset+2); + if (tag > 0 && tag <= 0x1f) { + sprintf(dest, "Tag:%u, Value:", tag); + cont=&cont[strlen(cont)]; + rdconvertbufftostr(cont,tvb,offset+3,avph->avp_length-3); + break; } rdconvertbufftostr(cont,tvb,offset+2,avph->avp_length-2); break; |