When calculating checksum for p_mul the checksum field itself is set to zero.

Ensure this field is inside the buffer before altering it, so we don't 
write outside the allocated buffer.

svn path=/trunk/; revision=22529
This commit is contained in:
Stig Bjørlykke 2007-08-16 20:54:43 +00:00
parent 8d76d4130e
commit 1ac635cd7d
1 changed files with 6 additions and 1 deletions

View File

@ -185,6 +185,11 @@ static guint16 checksum (guint8 *buffer, gint len, gint offset)
gint16 cs;
guint8 *hpp, *pls;
if (len < offset+2) {
/* Buffer to small */
return 0;
}
buffer[offset] = 0;
buffer[offset+1] = 0;
ctmp = len - offset - 1;
@ -331,11 +336,11 @@ static void dissect_p_mul (tvbuff_t *tvb, packet_info *pinfo _U_,
offset += 2;
/* Checksum */
en = proto_tree_add_item (p_mul_tree, hf_checksum, tvb, offset, 2, FALSE);
len = tvb_length (tvb);
value = tvb_get_ephemeral_string (tvb, 0, len);
checksum1 = checksum (value, len, offset);
checksum2 = tvb_get_ntohs (tvb, offset);
en = proto_tree_add_item (p_mul_tree, hf_checksum, tvb, offset, 2, FALSE);
if (checksum1 == checksum2) {
proto_item_append_text (en, " (correct)");
} else {