[bugzilla-daemon@xxxxxxxxxxxxx]

Comment # 26 on bug 3290 from Jakub Zawadzki

Hi,

Found possible integer overflow:

+       gint size = length;
/* asume size == 4 */

+           n = get_uint_value(tree, tvb, start, length, little_endian);
/* assume n == = 0xFFFFFFFE */

+           size += n;
/* size = 2 */

---

      You are receiving this mail because:

• You are the assignee for the bug.
• You are watching all bug changes.