b1047b
diff --git a/epan/proto.c b/epan/proto.c
b1047b
index 004acb0..bf98a27 100644
b1047b
--- a/epan/proto.c
b1047b
+++ b/epan/proto.c
b1047b
@@ -1758,6 +1758,31 @@ proto_tree_new_item(field_info *new_fi, proto_tree *tree,
b1047b
 	return pi;
b1047b
 }
b1047b
 
b1047b
+
b1047b
+/*
b1047b
+ * Validates that field length bytes are available starting from
b1047b
+ * start (pos/neg). Throws an exception if they aren't.
b1047b
+ */
b1047b
+static void
b1047b
+test_length(header_field_info *hfinfo, tvbuff_t *tvb,
b1047b
+	    gint start, gint length)
b1047b
+{
b1047b
+	gint size = length;
b1047b
+
b1047b
+	if (!tvb)
b1047b
+		return;
b1047b
+
b1047b
+	if (hfinfo->type == FT_STRINGZ) {
b1047b
+		/* If we're fetching until the end of the TVB, only validate
b1047b
+		 * that the offset is within range.
b1047b
+		 */
b1047b
+		if (length == -1)
b1047b
+			size = 0;
b1047b
+	}
b1047b
+
b1047b
+	tvb_ensure_bytes_exist(tvb, start, size);
b1047b
+}
b1047b
+
b1047b
 /* Gets data from tvbuff, adds it to proto_tree, increments offset,
b1047b
    and returns proto_item* */
b1047b
 proto_item *
b1047b
@@ -1786,6 +1811,8 @@ ptvcursor_add(ptvcursor_t *ptvc, int hfindex, gint length,
b1047b
 		ptvc->offset += n;
b1047b
 	}
b1047b
 
b1047b
+	test_length(hfinfo, ptvc->tvb, offset, item_length);
b1047b
+
b1047b
 	/* Coast clear. Try and fake it */
b1047b
 	TRY_TO_FAKE_THIS_ITEM(ptvc->tree, hfindex, hfinfo);
b1047b
 
b1047b
@@ -1795,45 +1822,6 @@ ptvcursor_add(ptvcursor_t *ptvc, int hfindex, gint length,
b1047b
 		offset, length, encoding);
b1047b
 }
b1047b
 
b1047b
-/*
b1047b
- * Validates that field length bytes are available starting from
b1047b
- * start (pos/neg). Throws an exception if they aren't.
b1047b
- */
b1047b
-static void
b1047b
-test_length(header_field_info *hfinfo, proto_tree *tree, tvbuff_t *tvb,
b1047b
-	    gint start, gint length, const guint encoding)
b1047b
-{
b1047b
-	gint size = length;
b1047b
-
b1047b
-	if (!tvb)
b1047b
-		return;
b1047b
-
b1047b
-	if (hfinfo->type == FT_UINT_BYTES || hfinfo->type == FT_UINT_STRING) {
b1047b
-		guint32 n;
b1047b
-
b1047b
-		n = get_uint_value(tree, tvb, start, length, encoding);
b1047b
-		if (n > size + n) {
b1047b
-			/* If n > size + n then we have an integer overflow, so
b1047b
-			 * set size to -1, which will force the
b1047b
-			 * tvb_ensure_bytes_exist call below to throw a
b1047b
-			 * ReportedBoundsError
b1047b
-			 */
b1047b
-			size = -1;
b1047b
-		}
b1047b
-		else {
b1047b
-			size += n;
b1047b
-		}
b1047b
-	} else if (hfinfo->type == FT_STRINGZ) {
b1047b
-		/* If we're fetching until the end of the TVB, only validate
b1047b
-		 * that the offset is within range.
b1047b
-		 */
b1047b
-		if (length == -1)
b1047b
-			size = 0;
b1047b
-	}
b1047b
-
b1047b
-	tvb_ensure_bytes_exist(tvb, start, size);
b1047b
-}
b1047b
-
b1047b
 /* Add an item to a proto_tree, using the text label registered to that item;
b1047b
    the item is extracted from the tvbuff handed to it. */
b1047b
 proto_item *
b1047b
@@ -1845,7 +1833,7 @@ proto_tree_add_item(proto_tree *tree, const int hfindex, tvbuff_t *tvb,
b1047b
 	gint		  item_length;
b1047b
 
b1047b
 	hfinfo = get_hfi_and_length(hfindex, tvb, start, &length, &item_length);
b1047b
-	test_length(hfinfo, tree, tvb, start, item_length, encoding);
b1047b
+	test_length(hfinfo, tvb, start, item_length);
b1047b
 
b1047b
 	TRY_TO_FAKE_THIS_ITEM(tree, hfindex, hfinfo);
b1047b
 
b1047b
@@ -7540,7 +7528,7 @@ proto_tree_add_bits_item(proto_tree *tree, const int hf_index, tvbuff_t *tvb,
b1047b
 
b1047b
 	octet_length = (no_of_bits + 7) >> 3;
b1047b
 	octet_offset = bit_offset >> 3;
b1047b
-	test_length(hfinfo, tree, tvb, octet_offset, octet_length, encoding);
b1047b
+	test_length(hfinfo, tvb, octet_offset, octet_length);
b1047b
 
b1047b
 	/* Yes, we try to fake this item again in proto_tree_add_bits_ret_val()
b1047b
 	 * but only after doing a bunch more work (which we can, in the common