Patch from Olivier Abad:

	packet-lapb.c :
	check the validity of the first byte in the frame.

	packet-x25.c :
	- in get_x25_pkt_len() : check that we are not reading after the end of
	the captured data
	- in dissect_x25() : various checks to avoid reading after the end of
	the captured data

	- in dissect_x25() : use offset (and not 2) as the length of the
	underlying protocol header.

	Olivier

svn path=/trunk/; revision=669

1 files changed, 11 insertions, 1 deletions

diff --git a/packet-lapb.c b/packet-lapb.c
index c4cb9d203e..d748cec1c2 100644
--- a/packet-lapb.c
+++ b/packet-lapb.c
@@ -2,7 +2,7 @@
  * Routines for lapb frame disassembly
  * Olivier Abad <abad@daba.dhis.org>
  *
- * $Id: packet-lapb.c,v 1.4 1999/08/20 06:55:07 guy Exp $
+ * $Id: packet-lapb.c,v 1.5 1999/09/12 18:37:01 guy Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@zing.org>
@@ -55,6 +55,16 @@ dissect_lapb(const u_char *pd, frame_data *fd, proto_tree *tree)
 
     if(check_col(fd, COL_RES_DL_SRC))
 	col_add_fstr(fd, COL_RES_DL_SRC, "0x%02X", pd[0]);
+    if (pd[0] != 0x01 && pd[0] != 0x03) /* invalid LAPB frame */
+    {
+	if (check_col(fd, COL_INFO))
+	    col_add_str(fd, COL_INFO, "Invalid LAPB frame");
+	if (tree)
+	    ti = proto_tree_add_item_format(tree, proto_lapb, 0, fd->cap_len,
+			                    NULL, "Invalid LAPB frame");
+	return;
+    }
+
     if (fd->pseudo_header.x25.flags & FROM_DCE) {
 	if(check_col(fd, COL_RES_DL_DST))
 	    col_add_str(fd, COL_RES_DL_DST, "DTE");