Blame SOURCES/wireshark-1.10.14-CVE-2015-6245.patch

dbc6ab
diff --git a/epan/dissectors/packet-gsm_rlcmac.c b/epan/dissectors/packet-gsm_rlcmac.c
dbc6ab
index e4eac08..7a783ef 100644
dbc6ab
--- a/epan/dissectors/packet-gsm_rlcmac.c
dbc6ab
+++ b/epan/dissectors/packet-gsm_rlcmac.c
dbc6ab
@@ -60,7 +60,7 @@
dbc6ab
 /* private typedefs */
dbc6ab
 typedef struct
dbc6ab
 {
dbc6ab
-   guint8 offset;
dbc6ab
+   gint   offset;
dbc6ab
    guint8 li;
dbc6ab
 }length_indicator_t;
dbc6ab
 
dbc6ab
@@ -6737,10 +6737,11 @@ static const value_string gsm_rlcmac_t3192_vals[] = {
dbc6ab
   { 0, NULL}
dbc6ab
 };
dbc6ab
 
dbc6ab
-static guint8 construct_gprs_data_segment_li_array(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, guint8 initial_offset, guint8 *li_count, length_indicator_t *li_array, guint64 *e)
dbc6ab
+static gint construct_gprs_data_segment_li_array(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, guint8 initial_offset, guint8 *li_count, length_indicator_t *li_array, guint64 *e)
dbc6ab
 {
dbc6ab
-    guint8 offset = initial_offset, li_array_size = *li_count;
dbc6ab
-	proto_item 	*item;
dbc6ab
+    gint        offset = initial_offset;
dbc6ab
+    guint8      li_array_size = *li_count;
dbc6ab
+    proto_item  *item;
dbc6ab
 
dbc6ab
     *li_count = 0;
dbc6ab
     while(*e == 0)
dbc6ab
@@ -6763,15 +6764,15 @@ static guint8 construct_gprs_data_segment_li_array(tvbuff_t *tvb, proto_tree *tr
dbc6ab
     return (offset - initial_offset);
dbc6ab
 }
dbc6ab
 
dbc6ab
-static guint8 construct_egprs_data_segment_li_array(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, guint8 initial_offset, guint8 *li_count, length_indicator_t *li_array, guint64 *e)
dbc6ab
+static gint construct_egprs_data_segment_li_array(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, guint8 initial_offset, guint8 *li_count, length_indicator_t *li_array, guint64 *e)
dbc6ab
 {
dbc6ab
-    guint8 offset = initial_offset, li_array_size = *li_count;
dbc6ab
-	proto_item 	*item;
dbc6ab
+    gint        offset = initial_offset;
dbc6ab
+    guint8      li_array_size = *li_count;
dbc6ab
+    proto_item  *item;
dbc6ab
 
dbc6ab
     *li_count = 0;
dbc6ab
     while(*e == 0)
dbc6ab
     {
dbc6ab
-        DISSECTOR_ASSERT(*li_count < li_array_size);
dbc6ab
         item = proto_tree_add_bits_item(tree, hf_li, tvb, offset * 8, 7, ENC_BIG_ENDIAN);
dbc6ab
         proto_tree_add_bits_ret_val(tree, hf_e, tvb, (offset * 8) + 7, 1, e, ENC_BIG_ENDIAN);
dbc6ab
         if(*li_count < li_array_size)
dbc6ab
@@ -7466,7 +7467,7 @@ dissect_ul_gprs_block(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, RlcMa
dbc6ab
    csnStream_t      ar;
dbc6ab
    guint8 payload_type = tvb_get_bits8(tvb, 0, 2);
dbc6ab
    guint16 bit_length = tvb_length(tvb) * 8;
dbc6ab
-   guint16 bit_offset = 0;
dbc6ab
+   gint bit_offset = 0;
dbc6ab
    length_indicator_t li_array[10];
dbc6ab
    guint8 li_count = array_length(li_array);
dbc6ab
 
dbc6ab
@@ -7595,7 +7596,7 @@ dissect_egprs_ul_data_block(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
dbc6ab
 {
dbc6ab
    proto_item   *ti = NULL;
dbc6ab
    proto_tree *data_tree = NULL;
dbc6ab
-   guint8 offset = 0;
dbc6ab
+   gint offset = 0;
dbc6ab
    length_indicator_t li_array[20];
dbc6ab
    guint8 li_count = array_length(li_array);
dbc6ab
    guint64 e, tlli_i;
dbc6ab
@@ -7655,7 +7656,8 @@ dissect_egprs_dl_data_block(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
dbc6ab
 {
dbc6ab
     proto_item      *ti = NULL;
dbc6ab
     proto_tree      *data_tree = NULL;
dbc6ab
-    guint16 offset = 0, block_number;
dbc6ab
+    gint offset = 0;
dbc6ab
+    guint16 block_number;
dbc6ab
     length_indicator_t li_array[20];
dbc6ab
     guint8 li_count = array_length(li_array);
dbc6ab
     guint64 fbi, e;