In tvb_get_string(), throw an exception if our length is less than zero.

Add a message block length check to the AIM dissector.

svn path=/trunk/; revision=13955

1 files changed, 6 insertions, 2 deletions

diff --git a/epan/tvbuff.c b/epan/tvbuff.c
index 11e029106b..c184d9ba9e 100644
--- a/epan/tvbuff.c
+++ b/epan/tvbuff.c
@@ -1711,12 +1711,16 @@ guint8 *
 tvb_get_string(tvbuff_t *tvb, gint offset, gint length)
 {
 	const guint8 *ptr;
-	guint8 *strbuf;
+	guint8 *strbuf = NULL;
+
+	if (length < 0)
+		THROW(DissectorError);
 
 	ptr = ensure_contiguous(tvb, offset, length);
 	strbuf = g_malloc(length + 1);
-	if (length != 0)
+	if (length != 0) {
 		memcpy(strbuf, ptr, length);
+	}
 	strbuf[length] = '\0';
 	return strbuf;
 }