From 8e0186b2da66be0b950631940dfa9fc35a5f8632 Mon Sep 17 00:00:00 2001
From: Gerald Combs <gerald@wireshark.org>
Date: Mon, 18 Apr 2005 16:29:54 +0000
Subject: Detect an infinite loop in dissect_rsvp_ero_rro_subobjects().  Fixes
 bug 71.

svn path=/trunk/; revision=14128
---
 epan/dissectors/packet-rsvp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/epan/dissectors/packet-rsvp.c b/epan/dissectors/packet-rsvp.c
index 46a1cf9688..59753a61ea 100644
--- a/epan/dissectors/packet-rsvp.c
+++ b/epan/dissectors/packet-rsvp.c
@@ -3330,6 +3330,8 @@ dissect_rsvp_ero_rro_subobjects (proto_tree *ti, proto_tree *rsvp_object_tree,
 
 	}
 
+	if(tvb_get_guint8(tvb, offset+l+1) == 0)
+	    THROW(ReportedBoundsError);
 	l += tvb_get_guint8(tvb, offset+l+1);
 	if (l < obj_length - 4) {
 	    if (i < 4)
-- 
cgit v1.2.3