From Tony Trinh via bug 5895:

Add sanity checks in range.c


git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@37784 f5534014-38df-0310-8fa8-9805f1628bb7

1 files changed, 23 insertions, 12 deletions

diff --git a/epan/range.c b/epan/range.c
index ffa1ab11f8..37bc77f284 100644
--- a/epan/range.c
+++ b/epan/range.c
@@ -107,6 +107,9 @@ range_convert_str_work(range_t **rangep, const gchar *es, guint32 max_value,
    guint32       tmp;
    unsigned long val;
 
+   if ( (rangep == NULL) || (es == NULL) )
+       return CVT_SYNTAX_ERROR;
+   
    /* Allocate a range; this has room for one subrange. */
    range = g_malloc(RANGE_HDR_SIZE + sizeof (range_admin_t));
    range->nranges = 0;
@@ -289,6 +292,9 @@ ranges_are_equal(range_t *a, range_t *b)
 {
    guint i;
 
+   if ( (a == NULL) || (b == NULL) )
+       return FALSE;
+   
    if (a->nranges != b->nranges)
       return FALSE;
 
@@ -311,10 +317,12 @@ void
 range_foreach(range_t *range, void (*callback)(guint32 val))
 {
    guint32 i, j;
-
-   for (i=0; i < range->nranges; i++) {
-      for (j = range->ranges[i].low; j <= range->ranges[i].high; j++)
-	 callback(j);
+   
+   if (range && callback) {
+      for (i=0; i < range->nranges; i++) {
+         for (j = range->ranges[i].low; j <= range->ranges[i].high; j++)
+	    callback(j);
+      }
    }
 }
 
@@ -328,15 +336,16 @@ range_convert_range(range_t *range)
 
    strbuf=ep_strbuf_new(NULL);
 
-   for (i=0; i < range->nranges; i++) {
-      if (range->ranges[i].low == range->ranges[i].high) {
-	 ep_strbuf_append_printf(strbuf, "%s%u", prepend_comma?",":"", range->ranges[i].low);
-      } else {
-	 ep_strbuf_append_printf(strbuf, "%s%u-%u", prepend_comma?",":"", range->ranges[i].low, range->ranges[i].high);
+   if (range) {
+      for (i=0; i < range->nranges; i++) {
+         if (range->ranges[i].low == range->ranges[i].high) {
+            ep_strbuf_append_printf(strbuf, "%s%u", prepend_comma?",":"", range->ranges[i].low);
+         } else {
+            ep_strbuf_append_printf(strbuf, "%s%u-%u", prepend_comma?",":"", range->ranges[i].low, range->ranges[i].high);
+         }
+         prepend_comma = TRUE;
       }
-      prepend_comma = TRUE;
    }
-
    return strbuf->str;
 }
 
@@ -347,6 +356,9 @@ range_copy(range_t *src)
    range_t *dst;
    size_t range_size;
 
+   if (src == NULL)
+       return NULL;
+   
    range_size = RANGE_HDR_SIZE + src->nranges*sizeof (range_admin_t);
    dst = g_malloc(range_size);
    memcpy(dst, src, range_size);
@@ -358,7 +370,6 @@ range_copy(range_t *src)
 static void
 value_is_in_range_check(range_t *range, guint32 val)
 {
-
   /* Print the result for a given value */
   printf("Function : value_is_in_range_check Number %u\t",val);