diff --git a/epan/dissectors/packet-bzr.c.old b/epan/dissectors/packet-bzr.c index be1becb..94d1c7f 100644 --- a/epan/dissectors/packet-bzr.c.old +++ b/epan/dissectors/packet-bzr.c @@ -85,7 +85,7 @@ static guint get_bzr_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset) { int next_offset; - gint len = 0; + gint len = 0, current_len; gint protocol_version_len; guint8 cmd = 0; @@ -98,7 +98,10 @@ get_bzr_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset) len += protocol_version_len + 1; /* Headers */ + current_len = len; len += get_bzr_prefixed_len(tvb, next_offset); + if (current_len > len) /* Make sure we're not going backwards */ + return -1; while (tvb_reported_length_remaining(tvb, offset + len) > 0) { cmd = tvb_get_guint8(tvb, offset + len); @@ -107,7 +110,10 @@ get_bzr_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset) switch (cmd) { case 's': case 'b': + current_len = len; len += get_bzr_prefixed_len(tvb, offset + len); + if (current_len > len) /* Make sure we're not going backwards */ + return -1; break; case 'o': len += 1; @@ -130,8 +130,8 @@ dissect_prefixed_bencode(tvbuff_t *tvb, gint offset, packet_info *pinfo _U_, plen = tvb_get_ntohl(tvb, offset); - ti = proto_tree_add_item(tree, hf_bzr_prefixed_bencode, tvb, offset, 4 + - plen, ENC_NA); + ti = proto_tree_add_item(tree, hf_bzr_prefixed_bencode, tvb, offset, -1, + ENC_NA); prefixed_bencode_tree = proto_item_add_subtree(ti, ett_prefixed_bencode); if (prefixed_bencode_tree) @@ -143,6 +143,8 @@ dissect_prefixed_bencode(tvbuff_t *tvb, gint offset, packet_info *pinfo _U_, tvb, offset+4, plen, ENC_NA); } + proto_item_set_len(ti, 4 + plen); + return 4 + plen; } @@ -156,18 +158,16 @@ dissect_prefixed_bytes(tvbuff_t *tvb, gint offset, packet_info *pinfo _U_, plen = tvb_get_ntohl(tvb, offset); - ti = proto_tree_add_item(tree, hf_bzr_bytes, tvb, offset, 4 + - plen, ENC_NA); + ti = proto_tree_add_item(tree, hf_bzr_bytes, tvb, offset, -1, ENC_NA); prefixed_bytes_tree = proto_item_add_subtree(ti, ett_prefixed_bytes); - if (prefixed_bytes_tree) - { - proto_tree_add_item(prefixed_bytes_tree, hf_bzr_bytes_length, - tvb, offset, 4, ENC_BIG_ENDIAN); + proto_tree_add_item(prefixed_bytes_tree, hf_bzr_bytes_length, + tvb, offset, 4, ENC_BIG_ENDIAN); - proto_tree_add_item(prefixed_bytes_tree, hf_bzr_bytes_data, - tvb, offset+4, plen, ENC_NA); - } + proto_tree_add_item(prefixed_bytes_tree, hf_bzr_bytes_data, + tvb, offset+4, plen, ENC_NA); + + proto_item_set_len(ti, 4 + plen); return 4 + plen; } @@ -267,7 +267,7 @@ proto_register_bzr(void) NULL, 0x0, NULL, HFILL }, }, { &hf_bzr_prefixed_bencode, - { "Bencode packet", "bzr.bencode", FT_BYTES, BASE_NONE, NULL, 0x0, + { "Bencode packet", "bzr.bencode", FT_NONE, BASE_NONE, NULL, 0x0, "Serialized structure of integers, dictionaries, strings and " "lists.", HFILL }, }, @@ -280,7 +280,7 @@ proto_register_bzr(void) NULL, 0x0, NULL, HFILL }, }, { &hf_bzr_bytes, - { "Prefixed bytes", "bzr.bytes", FT_BYTES, BASE_NONE, NULL, 0x0, + { "Prefixed bytes", "bzr.bytes", FT_NONE, BASE_NONE, NULL, 0x0, "Bytes field with prefixed 32-bit length", HFILL }, }, { &hf_bzr_bytes_data,