http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=rev&revision=52220
User: guy
Date: 2013/09/25 10:53 PM
Log:
Do all checks against the reported length; a packet that wasn't captured
in its entirety due to a snapshot length being specified is not
malformed.
Instead of checking for the the sum of the offset and the value length
being less than the offset, check whether the TLV length is <= 4 and, if
so, just quit at that point (that also handles the "value is zero
length" case). That makes sure that valuelength isn't negative; given
that length is < 65536, valuelength < 65532, so that won't cause offset
to overflow, so that means offset won't go backwards.
Directory: /trunk/epan/dissectors/
Changes Path Action
+15 -14 packet-dtp.c Modified