proto.c: add bounds check to proto_tree_add_text(_valist)_internal

Bug: 12659
Change-Id: I44cb3ce8e647ae2816d5ffa95435068c435a1e5c
Reviewed-on: https://code.wireshark.org/review/16648
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
This commit is contained in:
Pascal Quantin 2016-07-25 11:19:05 +02:00 committed by Anders Broman
parent 896751e013
commit 56706427f5
1 changed files with 16 additions and 0 deletions

View File

@ -1184,6 +1184,14 @@ proto_tree_add_text_internal(proto_tree *tree, tvbuff_t *tvb, gint start, gint l
va_list ap;
header_field_info *hfinfo;
if (length == -1) {
/* If we're fetching until the end of the TVB, only validate
* that the offset is within range.
*/
length = 0;
}
tvb_ensure_bytes_exist(tvb, start, length);
CHECK_FOR_NULL_TREE(tree);
TRY_TO_FAKE_THIS_ITEM(tree, hf_text_only, hfinfo);
@ -1207,6 +1215,14 @@ proto_tree_add_text_valist_internal(proto_tree *tree, tvbuff_t *tvb, gint start,
proto_item *pi;
header_field_info *hfinfo;
if (length == -1) {
/* If we're fetching until the end of the TVB, only validate
* that the offset is within range.
*/
length = 0;
}
tvb_ensure_bytes_exist(tvb, start, length);
CHECK_FOR_NULL_TREE(tree);
TRY_TO_FAKE_THIS_ITEM(tree, hf_text_only, hfinfo);