diff options
| -rw-r--r-- | asn1/spnego/spnego.cnf | 5 | ||||
| -rw-r--r-- | epan/dissectors/packet-ber.c | 13 | ||||
| -rw-r--r-- | epan/dissectors/packet-spnego.c | 5 |
3 files changed, 20 insertions, 3 deletions
diff --git a/asn1/spnego/spnego.cnf b/asn1/spnego/spnego.cnf index 476e4ce3b3..9b8fef959f 100644 --- a/asn1/spnego/spnego.cnf +++ b/asn1/spnego/spnego.cnf @@ -111,11 +111,14 @@ #.FN_BODY NegTokenInit/mechToken - tvbuff_t *mechToken_tvb; + tvbuff_t *mechToken_tvb = NULL; %(DEFAULT_BODY)s + if (! mechToken_tvb) { + THROW(ReportedBoundsError); + } /* * Now, we should be able to dispatch after creating a new TVB. diff --git a/epan/dissectors/packet-ber.c b/epan/dissectors/packet-ber.c index 886aaab46a..c5a968759f 100644 --- a/epan/dissectors/packet-ber.c +++ b/epan/dissectors/packet-ber.c @@ -1077,6 +1077,10 @@ printf("SEQUENCE dissect_ber_sequence(%s) calling subdissector\n",name); } } #endif + if (next_tvb == NULL) { + /* Assume that we have a malformed packet. */ + THROW(ReportedBoundsError); + } count=seq->func(pinfo, tree, next_tvb, 0); #ifdef DEBUG_BER @@ -1300,7 +1304,10 @@ printf("SET dissect_ber_set(%s) calling subdissector\n",name); } } #endif - + if (next_tvb == NULL) { + /* Assume that we have a malformed packet. */ + THROW(ReportedBoundsError); + } count=cset->func(pinfo, tree, next_tvb, 0); if(count) { @@ -1513,6 +1520,10 @@ printf("CHOICE dissect_ber_choice(%s) calling subdissector len:%d\n",name,tvb_le } } #endif + if (next_tvb == NULL) { + /* Assume that we have a malformed packet. */ + THROW(ReportedBoundsError); + } count=ch->func(pinfo, tree, next_tvb, 0); #ifdef DEBUG_BER { diff --git a/epan/dissectors/packet-spnego.c b/epan/dissectors/packet-spnego.c index 3fce23f1c4..b0c33eb9bb 100644 --- a/epan/dissectors/packet-spnego.c +++ b/epan/dissectors/packet-spnego.c @@ -238,13 +238,16 @@ static int dissect_reqFlags(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, static int dissect_spnego_T_mechToken(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index _U_) { - tvbuff_t *mechToken_tvb; + tvbuff_t *mechToken_tvb = NULL; offset = dissect_ber_octet_string(implicit_tag, pinfo, tree, tvb, offset, hf_index, &mechToken_tvb); + if (! mechToken_tvb) { + THROW(ReportedBoundsError); + } /* * Now, we should be able to dispatch after creating a new TVB. |