Guy Harris wrote:
> gerald@xxxxxxxxxxxx wrote:
>
>> User: gerald
>> Date: 2005/04/26 05:19 PM
>>
>> Log:
>> Add a bunch of tvb_ensure_bytes_exist() calls. Fixes bug 106.
>
>
> How many of those were to fix dissector bug reports from the test at
> line 2238 of proto.c?
>
> The only valid negative length in a protocol tree item is -1, for "to
> the end of the tvbuff". In most if not all other cases, a negative
> length is probably a positive length >= 2^31, which means that the item
> is probably going to run past the end of the tvbuff; should we, instead
> of reporting a dissector bug for a negative length other than -1 in
> alloc_field_info(), do a tvb_ensure_bytes_exist(), and throw the
> exception there? That might fix many of the existing bugs where
> tvb_ensure_bytes_exist() was added before proto_tree_add_item() calls,
> and also fix undiscovered bugs of that sort and prevent future ones?
Most of them were due to the length being less than -1. I'll go ahead
and add the check to alloc_field_info().