https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4984
Tomas Hoger <thoger@xxxxxxxxxx> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |thoger@xxxxxxxxxx
--- Comment #4 from Tomas Hoger <thoger@xxxxxxxxxx> 2010-07-07 12:44:59 PDT ---
(In reply to comment #1)
> Fixed in 33464 by making sure the offset is positive before recursing.
Jeff, is the added check sufficient in all cases? tmp_offset += tmp_len should
still be able to move tmp_offset back, but without making it less than offset
(as tmp_len can be arbitrary 32bit value when 8.1.3.5 branch is followed). It
may no longer be possible to cause deep recursion, but still seems to allow
infinite loop.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.