From ee185445f410b6bc54831ea0923af08cbcd75d00 Mon Sep 17 00:00:00 2001 From: Michael Mann Date: Tue, 24 Jan 2017 23:06:04 -0500 Subject: rtmpt: Ensure sequence count is incremented for stored fragments Bug: 13347 Change-Id: I351c80dea8ac7a9f2540b40782b1cc5c0b8fdaed Reviewed-on: https://code.wireshark.org/review/19777 Reviewed-by: Anders Broman --- epan/dissectors/packet-rtmpt.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'epan/dissectors/packet-rtmpt.c') diff --git a/epan/dissectors/packet-rtmpt.c b/epan/dissectors/packet-rtmpt.c index 74e88f4e72..1b27f0914e 100644 --- a/epan/dissectors/packet-rtmpt.c +++ b/epan/dissectors/packet-rtmpt.c @@ -1876,6 +1876,7 @@ dissect_rtmpt_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, rtmpt_ guint8 cmd; guint32 src; int chunk_size; + guint32 save_seq = 0; rtmpt_frag_t *tf; rtmpt_id_t *ti; @@ -1898,8 +1899,9 @@ dissect_rtmpt_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, rtmpt_ wmem_stack_push(packets, 0); tp = (rtmpt_packet_t *)wmem_tree_lookup32_le(rconv->packets[cdir], seq+remain-1); - while (tp && tp->lastseq >= seq) { + while (tp && tp->lastseq >= seq && tp->lastseq >= save_seq) { wmem_stack_push(packets, tp); + save_seq = tp->lastseq+1; /* Ensure sequence is increasing */ tp = (rtmpt_packet_t *)wmem_tree_lookup32_le(rconv->packets[cdir], tp->lastseq-1); } -- cgit v1.2.3