Don't write out packets that have a "captured length" bigger than we're

willing to read or that's bigger than will fit in the file format;
instead, report an error.

For the "I can't write a packet of that type in that file type" error,
report the file type in question.

svn path=/trunk/; revision=54882

1 files changed, 7 insertions, 0 deletions

diff --git a/wiretap/network_instruments.c b/wiretap/network_instruments.c
index 2e9f340288..07e3e3a7e2 100644
--- a/wiretap/network_instruments.c
+++ b/wiretap/network_instruments.c
@@ -699,6 +699,13 @@ static gboolean observer_dump(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
     packet_entry_header           packet_header;
     guint64                       seconds_since_2000;
 
+    /* The captured size field is 16 bits, so there's a hard limit of
+       65535. */
+    if (phdr->caplen > 65535) {
+        *err = WTAP_ERR_PACKET_TOO_LARGE;
+        return FALSE;
+    }
+
     /* convert the number of seconds since epoch from ANSI-relative to
        Observer-relative */
     if (phdr->ts.secs < ansi_to_observer_epoch_offset) {