When trying to handle gzip-compressed data, don't seek past the end of our

compressed data buffer.  Fixes bug 288.


git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@14981 f5534014-38df-0310-8fa8-9805f1628bb7

1 files changed, 6 insertions, 0 deletions

diff --git a/epan/tvbuff.c b/epan/tvbuff.c
index aff4825cad..e3878bf76e 100644
--- a/epan/tvbuff.c
+++ b/epan/tvbuff.c
@@ -2408,6 +2408,12 @@ tvb_uncompress(tvbuff_t *tvb, int offset, int comprlen)
 			inflateReset(strm);
 			next = c;
 			strm->next_in = next;
+			if (c - compr > comprlen) {
+				g_free(strm);
+				g_free(compr);
+				g_free(strmbuf);
+				return NULL;
+			}
 			comprlen -= (c - compr);
 			
 			err = inflateInit2(strm, wbits);