diff options
| author | Jaap Keuter <jaap.keuter@xs4all.nl> | 2007-12-13 08:02:29 +0000 |
|---|---|---|
| committer | Jaap Keuter <jaap.keuter@xs4all.nl> | 2007-12-13 08:02:29 +0000 |
| commit | b5a733b0a8069bb6e8ccb5befb7bc4c5c99d0db8 (patch) | |
| tree | bbd689f6501da59342db13af299002f4d2152ea7 /plugins/unistim | |
| parent | 160d7b71afe5b713ad31cb248f614f462002e1a4 (diff) | |
Fix for bug 2098:
Test that message length is at least the minumum required, otherwise generate expert item..
svn path=/trunk/; revision=23854
Diffstat (limited to 'plugins/unistim')
| -rw-r--r-- | plugins/unistim/packet-unistim.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/plugins/unistim/packet-unistim.c b/plugins/unistim/packet-unistim.c index c2f0407d75..0895af17c2 100644 --- a/plugins/unistim/packet-unistim.c +++ b/plugins/unistim/packet-unistim.c @@ -32,6 +32,7 @@ #include <epan/packet.h> #include <epan/tap.h> #include <epan/emem.h> +#include <epan/expert.h> #include <epan/address.h> #include <epan/dissectors/packet-rtp.h> #include <epan/dissectors/packet-rtcp.h> @@ -410,8 +411,15 @@ dissect_unistim_message(proto_tree *unistim_tree,packet_info *pinfo,tvbuff_t *tv offset+=1; msg_len=tvb_get_guint8(tvb,offset); - proto_item_set_len(ti, msg_len); - proto_tree_add_item(msg_tree,hf_unistim_len,tvb,offset,1,FALSE); + if (msg_len<=2) + { + ti=proto_tree_add_item(msg_tree,hf_unistim_len,tvb,offset,1,FALSE); + expert_add_info_format(pinfo,ti,PI_MALFORMED,PI_ERROR,"Length too short"); + return tvb_length(tvb); + } else { + proto_item_set_len(ti,msg_len); + proto_tree_add_item(msg_tree,hf_unistim_len,tvb,offset,1,FALSE); + } offset+=1; /*from switch*/ |