[Abhijit Menon-Sen <ams@xxxxxxxx>]

At 2005-02-19 17:25:23 +0530, ams@xxxxxxxx wrote:
>
>   @@ -521,13 +521,14 @@ void dissect_pgsql_fe_msg(guchar type, g
>            shrub = proto_item_add_subtree(ti, ett_values);
>            n += 2;
>            while (i-- > 0) {
>   -            l = tvb_get_ntohl(tvb, n);
>   +            gint l = tvb_get_ntohl(tvb, n);
>                proto_tree_add_int(shrub, hf_val_length, tvb, n, 4, l);
>                n += 4;
>   -            if (l > 0) {
>   +            /* XXX - if we don't limit l here, the function will [...] */
>   +            if (l > 0 && l < 1000000)
>                    proto_tree_add_item(shrub, hf_val_data, tvb, n, l, FALSE);
>   +            if ( l > 0 )
>                    n += l;
>   -            }
>            }

Oops.

I'm sorry, I diffed the temporarily-patched version rather than the code
that's actually in 0.9.10.

In case this caused any confusion, the problem was that code like this:

    gint l = tvb_get_ntohl( ... );

    if ( l > 0 ) {
        ...
        n += l;
    }

Was changed to this:

    guint32 l = tvb_get_ntohl( ... );

    if ( l > 0 && l < 1000000 )
        ...
    n += l;

And that last increment should be done only if l > 0.

-- ams