Fix https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2649 by adding some length checks to two while loops in tvb_uncompress()
svn path=/trunk/; revision=25677
This commit is contained in:
parent
6f286b94fb
commit
73f7073540
|
@ -875,7 +875,7 @@ fast_ensure_contiguous(tvbuff_t *tvb, gint offset, guint length)
|
|||
if (end_offset <= tvb->length) {
|
||||
return tvb->real_data + u_offset;
|
||||
}
|
||||
|
||||
|
||||
if (end_offset > tvb->reported_length) {
|
||||
THROW(ReportedBoundsError);
|
||||
}
|
||||
|
@ -2893,7 +2893,7 @@ tvb_uncompress(tvbuff_t *tvb, int offset, int comprlen)
|
|||
if (flags & (1 << 3)) {
|
||||
/* A null terminated filename */
|
||||
|
||||
while (*c != '\0') {
|
||||
while ((c - compr) < comprlen && *c != '\0') {
|
||||
c++;
|
||||
}
|
||||
|
||||
|
@ -2903,7 +2903,7 @@ tvb_uncompress(tvbuff_t *tvb, int offset, int comprlen)
|
|||
if (flags & (1 << 4)) {
|
||||
/* A null terminated comment */
|
||||
|
||||
while (*c != '\0') {
|
||||
while ((c - compr) < comprlen && *c != '\0') {
|
||||
c++;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue