25 lines
745 B
Diff
25 lines
745 B
Diff
|
--- trunk/epan/dissectors/packet-dcm.c 2011/04/30 08:36:00 36957
|
||
|
|
+++ trunk/epan/dissectors/packet-dcm.c 2011/04/30 17:43:05 36958
|
||
|
|
@@ -6519,6 +6519,7 @@
|
||
|
|
|
||
|
|
/* Process all PDUs in the buffer */
|
||
|
|
while (pdu_start < tlen) {
|
||
|
|
+ guint32 old_pdu_start;
|
||
|
|
|
||
|
|
if ((pdu_len+6) > (tlen-offset)) {
|
||
|
|
|
||
|
|
@@ -6539,7 +6540,13 @@
|
||
|
|
offset=dissect_dcm_pdu(tvb, pinfo, tree, pdu_start);
|
||
|
|
|
||
|
|
/* Next PDU */
|
||
|
|
+ old_pdu_start = pdu_start;
|
||
|
|
pdu_start = pdu_start + pdu_len + 6;
|
||
|
|
+ if (pdu_start <= old_pdu_start) {
|
||
|
|
+ expert_add_info_format(pinfo, NULL, PI_MALFORMED, PI_ERROR,
|
||
|
|
+ "Invalid PDU length (%u)", pdu_len);
|
||
|
|
+ THROW(ReportedBoundsError);
|
||
|
|
+ }
|
||
|
|
|
||
|
|
if (pdu_start < tlen - 6) {
|
||
|
|
/* we got at least 6 bytes of the next PDU still in the buffer */
|