From 3ec1e6ca590e2f840294d6a16f8e87261fae5299 Mon Sep 17 00:00:00 2001
From: John Thacker <johnthacker@gmail.com>
Date: Sun, 6 Nov 2022 08:43:31 -0500
Subject: [PATCH] afs: Validate vectorized strings

The RXStringV type has one character (octet) stored per 32
bit word. There's no real indication of the string encoding
(possibly locale dependent, maybe ASCII or UTF-8.) Validate
it as UTF-8 for now, to produce good UTF-8 and handle the latter
two cases.

Fix #18583.
---
 epan/dissectors/packet-afs.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/epan/dissectors/packet-afs.c b/epan/dissectors/packet-afs.c
index 28e4d33431..9e85420c0c 100644
--- a/epan/dissectors/packet-afs.c
+++ b/epan/dissectors/packet-afs.c
@@ -545,18 +545,23 @@ static void OUT_RXString(ptvcursor_t *cursor, int field)
 static void OUT_RXStringV(ptvcursor_t *cursor, int field, guint32 length)
 {
 	tvbuff_t* tvb = ptvcursor_tvbuff(cursor);
-	char* str = (char*)wmem_alloc(wmem_packet_scope(), length+1);
+	wmem_strbuf_t *strbuf = wmem_strbuf_sized_new(wmem_packet_scope(), length+1, 0);
 	int offset = ptvcursor_current_offset(cursor),
 		start_offset = offset;
 	guint32 idx;
 
 	for (idx = 0; idx<length; idx++)
 	{
-		str[idx] = (char)tvb_get_ntohl(tvb, offset);
+		wmem_strbuf_append_c(strbuf, (char)tvb_get_ntohl(tvb, offset));
 		offset += 4;
 	}
-	str[length] = '\0';
-	proto_tree_add_string(ptvcursor_tree(cursor), field, tvb, start_offset, length*4, str);
+	/* XXX: There's no indication what encoding this string has.
+	 * Treat it as UTF-8 for now.
+	 */
+	if (!wmem_strbuf_utf8_validate(strbuf, NULL)) {
+		wmem_strbuf_utf8_make_valid(strbuf);
+	}
+	proto_tree_add_string(ptvcursor_tree(cursor), field, tvb, start_offset, length*4, wmem_strbuf_finalize(strbuf));
 	ptvcursor_advance(cursor, length*4);
 }