https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6958
--- Comment #10 from Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> 2012-03-26 14:33:59 PDT ---
Apparently I didn't fuzz test this change long enough because it introduced an
infinite loop because this code:
while (length>0) {
- /* length can only be a multiple of 2, otherwise there is
- something broken -> so decode down until length is 1 */
- if (length!=1) {
does not have an 'else' on the quoted 'if' statement (so if length is 1 the
length will never be modified, leaving us in the 'while' loop forever).
I fixed it in r41778 by simply taking out the whole 'if' statement: if the
length happens to be too short the TVB access will throw an exception and stop
dissection. If that's not the desired behavior (for example it's normal that
the length might be 1) then please let me know and I could change the 'while'
loop to be "while (length > 1)".
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.