|
 |
b1047b |
diff --git a/epan/dissectors/packet-mmse.c.old b/epan/dissectors/packet-mmse.c
|
|
|
b1047b |
index aacebaf..2a74836 100644
|
|
|
b1047b |
--- a/epan/dissectors/packet-mmse.c.old
|
|
|
b1047b |
+++ b/epan/dissectors/packet-mmse.c
|
|
|
b1047b |
@@ -494,6 +494,12 @@ get_value_length(tvbuff_t *tvb, guint offset, guint *byte_count)
|
|
|
b1047b |
field = tvb_get_guintvar(tvb, offset, byte_count);
|
|
|
b1047b |
(*byte_count)++;
|
|
|
b1047b |
}
|
|
|
b1047b |
+
|
|
|
b1047b |
+ /* The packet says there are this many bytes; ensure they're there.
|
|
|
b1047b |
+ * We do this here because several callers do math on the length we
|
|
|
b1047b |
+ * return here and may not catch an overflow.
|
|
|
b1047b |
+ */
|
|
|
b1047b |
+ tvb_ensure_bytes_exist(tvb, offset, field);
|
|
|
b1047b |
return field;
|
|
|
b1047b |
}
|
|
|
b1047b |
|
|
|
b1047b |
@@ -699,7 +705,7 @@ static void
|
|
|
b1047b |
dissect_mmse(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint8 pdut,
|
|
|
b1047b |
const char *message_type)
|
|
|
b1047b |
{
|
|
|
b1047b |
- guint offset;
|
|
|
b1047b |
+ guint offset, old_offset;
|
|
|
b1047b |
guint8 field = 0;
|
|
|
b1047b |
const char *strval;
|
|
|
b1047b |
guint length;
|
|
|
b1047b |
@@ -734,6 +740,7 @@ dissect_mmse(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint8 pdut,
|
|
|
b1047b |
}
|
|
|
b1047b |
|
|
|
b1047b |
offset = 2; /* Skip Message-Type */
|
|
|
b1047b |
+ old_offset = 1;
|
|
|
b1047b |
|
|
|
b1047b |
/*
|
|
|
b1047b |
* Cycle through MMS-headers
|
|
|
b1047b |
@@ -1293,6 +1300,11 @@ dissect_mmse(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint8 pdut,
|
|
|
b1047b |
break;
|
|
|
b1047b |
}
|
|
|
b1047b |
DebugLog(("\tEnd(case)\n"));
|
|
|
b1047b |
+
|
|
|
b1047b |
+ if (offset <= old_offset) {
|
|
|
b1047b |
+ REPORT_DISSECTOR_BUG("Offset isn't increasing");
|
|
|
b1047b |
+ }
|
|
|
b1047b |
+ old_offset = offset;
|
|
|
b1047b |
}
|
|
|
b1047b |
DebugLog(("\tEnd(switch)\n"));
|
|
|
b1047b |
if (field == MM_CTYPE_HDR) {
|