[bugzilla-daemon@xxxxxxxxxxxxx]

Comment # 32 on bug 3290 from Jeff Morriss

(In reply to comment #31)
> While looking at Coverity issues ("dereferencing a NULL pointer") today, I
> found one potential issue with the fixes related to this bug:
> 
> In proto_tree_add_item(), we call test_length() before doing the NULL check
> on tree.
> 
> test_length() -> get_uint_value() -> report_type_length_mismatch() ->
> dereference tree -> crash
> 
> This can be triggered by something like
> 
> proto_tree_add_item(NULL, hf_dvbci_prof_name, tvb, offset, 7,
> ENC_BIG_ENDIAN);
> with hf_dvbci_prof_name being an FT_UINT_STRING
> 
> I understand that we must test_length() before TRY_TO_FAKE_THIS_ITEM().
> Therefore, I added a NULL check in report_type_length_mismatch() in r51020.
> 
> Feel free to modify / revert this if I got it wrong.

Oops, yeah, I forgot about the "throw exception if given an invalid length"
stuff.  Your fix looks good.

---

      You are receiving this mail because:

• You are the assignee for the bug.
• You are watching all bug changes.