diff --git a/epan/dissectors/packet-bzr.c.old b/epan/dissectors/packet-bzr.c
index be1becb..94d1c7f 100644
--- a/epan/dissectors/packet-bzr.c.old
+++ b/epan/dissectors/packet-bzr.c
@@ -85,7 +85,7 @@ static guint
get_bzr_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset)
{
int next_offset;
- gint len = 0;
+ gint len = 0, current_len;
gint protocol_version_len;
guint8 cmd = 0;
@@ -98,7 +98,10 @@ get_bzr_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset)
len += protocol_version_len + 1;
/* Headers */
+ current_len = len;
len += get_bzr_prefixed_len(tvb, next_offset);
+ if (current_len > len) /* Make sure we're not going backwards */
+ return -1;
while (tvb_reported_length_remaining(tvb, offset + len) > 0) {
cmd = tvb_get_guint8(tvb, offset + len);
@@ -107,7 +110,10 @@ get_bzr_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset)
switch (cmd) {
case 's':
case 'b':
+ current_len = len;
len += get_bzr_prefixed_len(tvb, offset + len);
+ if (current_len > len) /* Make sure we're not going backwards */
+ return -1;
break;
case 'o':
len += 1;
@@ -130,8 +130,8 @@ dissect_prefixed_bencode(tvbuff_t *tvb, gint offset, packet_info *pinfo _U_,
plen = tvb_get_ntohl(tvb, offset);
- ti = proto_tree_add_item(tree, hf_bzr_prefixed_bencode, tvb, offset, 4 +
- plen, ENC_NA);
+ ti = proto_tree_add_item(tree, hf_bzr_prefixed_bencode, tvb, offset, -1,
+ ENC_NA);
prefixed_bencode_tree = proto_item_add_subtree(ti, ett_prefixed_bencode);
if (prefixed_bencode_tree)
@@ -143,6 +143,8 @@ dissect_prefixed_bencode(tvbuff_t *tvb, gint offset, packet_info *pinfo _U_,
tvb, offset+4, plen, ENC_NA);
}
+ proto_item_set_len(ti, 4 + plen);
+
return 4 + plen;
}
@@ -156,18 +158,16 @@ dissect_prefixed_bytes(tvbuff_t *tvb, gint offset, packet_info *pinfo _U_,
plen = tvb_get_ntohl(tvb, offset);
- ti = proto_tree_add_item(tree, hf_bzr_bytes, tvb, offset, 4 +
- plen, ENC_NA);
+ ti = proto_tree_add_item(tree, hf_bzr_bytes, tvb, offset, -1, ENC_NA);
prefixed_bytes_tree = proto_item_add_subtree(ti, ett_prefixed_bytes);
- if (prefixed_bytes_tree)
- {
- proto_tree_add_item(prefixed_bytes_tree, hf_bzr_bytes_length,
- tvb, offset, 4, ENC_BIG_ENDIAN);
+ proto_tree_add_item(prefixed_bytes_tree, hf_bzr_bytes_length,
+ tvb, offset, 4, ENC_BIG_ENDIAN);
- proto_tree_add_item(prefixed_bytes_tree, hf_bzr_bytes_data,
- tvb, offset+4, plen, ENC_NA);
- }
+ proto_tree_add_item(prefixed_bytes_tree, hf_bzr_bytes_data,
+ tvb, offset+4, plen, ENC_NA);
+
+ proto_item_set_len(ti, 4 + plen);
return 4 + plen;
}
@@ -267,7 +267,7 @@ proto_register_bzr(void)
NULL, 0x0, NULL, HFILL },
},
{ &hf_bzr_prefixed_bencode,
- { "Bencode packet", "bzr.bencode", FT_BYTES, BASE_NONE, NULL, 0x0,
+ { "Bencode packet", "bzr.bencode", FT_NONE, BASE_NONE, NULL, 0x0,
"Serialized structure of integers, dictionaries, strings and "
"lists.", HFILL },
},
@@ -280,7 +280,7 @@ proto_register_bzr(void)
NULL, 0x0, NULL, HFILL },
},
{ &hf_bzr_bytes,
- { "Prefixed bytes", "bzr.bytes", FT_BYTES, BASE_NONE, NULL, 0x0,
+ { "Prefixed bytes", "bzr.bytes", FT_NONE, BASE_NONE, NULL, 0x0,
"Bytes field with prefixed 32-bit length", HFILL },
},
{ &hf_bzr_bytes_data,