diff options
author | gerald <gerald@f5534014-38df-0310-8fa8-9805f1628bb7> | 2002-05-12 20:43:29 +0000 |
---|---|---|
committer | gerald <gerald@f5534014-38df-0310-8fa8-9805f1628bb7> | 2002-05-12 20:43:29 +0000 |
commit | f6f65622f92004bcf04010e74db2ac0606220e64 (patch) | |
tree | b7d9673779daa9208017a3836f6b9d1301ccf4e3 /packet-giop.c | |
parent | fed5f5f5095957cc3ca8ef656cb05b37b337b2c3 (diff) |
Fix a bounds checking error in get_CDR_octet_seq.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@5452 f5534014-38df-0310-8fa8-9805f1628bb7
Diffstat (limited to 'packet-giop.c')
-rw-r--r-- | packet-giop.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/packet-giop.c b/packet-giop.c index bb33b5c801..8a8e12e3cb 100644 --- a/packet-giop.c +++ b/packet-giop.c @@ -9,7 +9,7 @@ * Frank Singleton <frank.singleton@ericsson.com> * Trevor Shepherd <eustrsd@am1.ericsson.se> * - * $Id: packet-giop.c,v 1.59 2002/05/02 19:39:05 guy Exp $ + * $Id: packet-giop.c,v 1.60 2002/05/12 20:43:29 gerald Exp $ * * Ethereal - Network traffic analyzer * By Gerald Combs <gerald@ethereal.com> @@ -2325,16 +2325,18 @@ guint8 get_CDR_octet(tvbuff_t *tvb, int *offset) { * This function also increments offset by len. */ -void get_CDR_octet_seq(tvbuff_t *tvb, gchar **seq, int *offset, int len) { +void get_CDR_octet_seq(tvbuff_t *tvb, gchar **seq, int *offset, guint32 len) { - if (! tvb_bytes_exist(tvb, *offset,len)) { + guint32 remain_len = tvb_length_remaining(tvb, *offset); + + if (remain_len < len) { /* * Generate an exception, and stop processing. * We do that now, rather than after allocating the buffer, so we * don't have to worry about freeing the buffer. * XXX - would we be better off using a cleanup routine? */ - tvb_get_guint8(tvb, *offset + len); + tvb_ensure_length_remaining(tvb, *offset + remain_len + 1); } /* @@ -2639,7 +2641,7 @@ guint16 get_CDR_ushort(tvbuff_t *tvb, int *offset, gboolean stream_is_big_endian gint8 get_CDR_wchar(tvbuff_t *tvb, gchar **seq, int *offset, MessageHeader * header) { - gint8 slength; + guint32 slength; gchar *raw_wstring; /* CORBA chapter 15: |