Michael Mann
changed
bug 9248
| What |
Removed |
Added |
| Attachment #11741 Flags |
|
review_for_checkin?
|
Comment # 5
on bug 9248
from Michael Mann
Created attachment 11741 [details]
Bugfix loop
I think the "loop break" should be a little higher than what was done in r52458
because if a "type" is unrecognized the rest of the tvb is "claimed", and
tvb_length_remaining should be 0 in the "map loop".
Also found a few places where offset wasn't properly incremented, which should
prevent some of the near-infinite loops.
While the capture in this bug wasn't a fuzz produced file, it does seem like
there is a "field mismatch" if the "expected" map length is significantly
larger than the packet size.
You are receiving this mail because:
- You are watching all bug changes.