From a7082d41b0a8ebb96ac0b7db3d27eb25aaef2ec7 Mon Sep 17 00:00:00 2001
From: Gerald Combs <gerald@wireshark.org>
Date: Thu, 28 Apr 2005 19:42:56 +0000
Subject: [PATCH] Break out of an infinite loop.  Fixes bug 138.

svn path=/trunk/; revision=14223
---
 epan/dissectors/packet-l2tp.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/epan/dissectors/packet-l2tp.c b/epan/dissectors/packet-l2tp.c
index fc265724ea..d8de5cc3d7 100644
--- a/epan/dissectors/packet-l2tp.c
+++ b/epan/dissectors/packet-l2tp.c
@@ -536,6 +536,12 @@ static void process_control_avps(tvbuff_t *tvb,
 			avp_vendor_id	= tvb_get_ntohs(tvb, index + 2);
 			avp_type	= tvb_get_ntohs(tvb, index + 4);
 
+			if (avp_len < 1) {
+				proto_tree_add_text(l2tp_avp_tree, tvb, index, 0,
+						    "AVP length must be >= 1");
+				return;
+			}
+
 			if (avp_vendor_id == VENDOR_IETF) {
 				tf =  proto_tree_add_text(l2tp_tree, tvb, index,
 							  avp_len, "%s AVP",