Blame SOURCES/wireshark-0017-CVE-19623.patch

4a42e1
diff --git a/epan/dissectors/packet-lbmpdm.c b/epan/dissectors/packet-lbmpdm.c
4a42e1
index 0df59329fd..16001b859c 100644
4a42e1
--- a/epan/dissectors/packet-lbmpdm.c
4a42e1
+++ b/epan/dissectors/packet-lbmpdm.c
4a42e1
@@ -12,6 +12,7 @@
4a42e1
 
4a42e1
 #include "config.h"
4a42e1
 #include <epan/packet.h>
4a42e1
+#include <epan/exceptions.h>
4a42e1
 #include "packet-lbm.h"
4a42e1
 
4a42e1
 /* Magic number for message header to check if data is big-endian or little-endian. */
4a42e1
@@ -837,7 +838,6 @@ static int dissect_segment_ofstable(tvbuff_t * tvb, int offset, packet_info * pi
4a42e1
     proto_tree * subtree = NULL;
4a42e1
     int datalen = 0;
4a42e1
     int seglen = 0;
4a42e1
-    int datalen_remaining = 0;
4a42e1
     int ofs = 0;
4a42e1
     int field_count = 0;
4a42e1
     int idx;
4a42e1
@@ -862,9 +862,8 @@ static int dissect_segment_ofstable(tvbuff_t * tvb, int offset, packet_info * pi
4a42e1
         id_list[idx] = -1;
4a42e1
         ofs_list[idx] = -1;
4a42e1
     }
4a42e1
-    datalen_remaining = datalen;
4a42e1
     ofs = offset + L_LBMPDM_SEG_HDR_T;
4a42e1
-    for (idx = 0; (idx < field_count) && (datalen_remaining >= L_LBMPDM_OFFSET_ENTRY_T); idx++, ofs += L_LBMPDM_OFFSET_ENTRY_T)
4a42e1
+    for (idx = 0; idx < field_count; idx++, ofs += L_LBMPDM_OFFSET_ENTRY_T)
4a42e1
     {
4a42e1
         proto_item * offset_item = NULL;
4a42e1
         proto_tree * offset_tree = NULL;
4a42e1
@@ -875,6 +874,9 @@ static int dissect_segment_ofstable(tvbuff_t * tvb, int offset, packet_info * pi
4a42e1
         id_list[idx] = (gint32)lbmpdm_fetch_uint32_encoded(tvb, ofs + O_LBMPDM_OFFSET_ENTRY_T_ID, encoding);
4a42e1
         proto_tree_add_item(offset_tree, hf_lbmpdm_offset_entry_offset, tvb, ofs + O_LBMPDM_OFFSET_ENTRY_T_OFFSET, L_LBMPDM_OFFSET_ENTRY_T_OFFSET, encoding);
4a42e1
         ofs_list[idx] = (gint32)lbmpdm_fetch_uint32_encoded(tvb, ofs + O_LBMPDM_OFFSET_ENTRY_T_OFFSET, encoding);
4a42e1
+        if (id_list[idx] < 0 || ofs_list[idx] < 0) {
4a42e1
+            THROW(ReportedBoundsError);
4a42e1
+        }
4a42e1
         if (id_list[idx] > max_index)
4a42e1
         {
4a42e1
             max_index = id_list[idx];