Blame SOURCES/wireshark-0009-CVE-2018-16057.patch

4a42e1
diff --git a/epan/dissectors/packet-ieee80211-radiotap-iter.c b/epan/dissectors/packet-ieee80211-radiotap-iter.c
4a42e1
index 56ca297434..4006637fb2 100644
4a42e1
--- a/epan/dissectors/packet-ieee80211-radiotap-iter.c
4a42e1
+++ b/epan/dissectors/packet-ieee80211-radiotap-iter.c
4a42e1
@@ -131,6 +131,7 @@ int ieee80211_radiotap_iterator_init(
4a42e1
 	iterator->_bitmap_shifter = get_unaligned_le32(&radiotap_header->it_present);
4a42e1
 	iterator->_arg = (guint8 *)radiotap_header + sizeof(*radiotap_header);
4a42e1
 	iterator->_reset_on_ext = 0;
4a42e1
+	iterator->_next_ns_data = NULL;
4a42e1
 	iterator->_next_bitmap = &radiotap_header->it_present;
4a42e1
 	iterator->_next_bitmap++;
4a42e1
 	iterator->_vns = vns;
4a42e1
@@ -287,9 +288,14 @@ int ieee80211_radiotap_iterator_next(
4a42e1
 			}
4a42e1
 			if (!align) {
4a42e1
 				/* skip all subsequent data */
4a42e1
+				if (!iterator->_next_ns_data)
4a42e1
+					return -EINVAL;
4a42e1
 				iterator->_arg = iterator->_next_ns_data;
4a42e1
 				/* give up on this namespace */
4a42e1
 				iterator->current_namespace = NULL;
4a42e1
+				iterator->_next_ns_data = NULL;
4a42e1
+				if (!ITERATOR_VALID(iterator, 0))
4a42e1
+					return -EINVAL;
4a42e1
 				goto next_entry;
4a42e1
 			}
4a42e1
 			break;