Fix https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2649 by adding some length checks to two while loops in tvb_uncompress()

svn path=/trunk/; revision=25677
This commit is contained in:
Jeff Morriss 2008-07-08 20:04:11 +00:00
parent 6f286b94fb
commit 73f7073540
1 changed files with 3 additions and 3 deletions

View File

@ -875,7 +875,7 @@ fast_ensure_contiguous(tvbuff_t *tvb, gint offset, guint length)
if (end_offset <= tvb->length) {
return tvb->real_data + u_offset;
}
if (end_offset > tvb->reported_length) {
THROW(ReportedBoundsError);
}
@ -2893,7 +2893,7 @@ tvb_uncompress(tvbuff_t *tvb, int offset, int comprlen)
if (flags & (1 << 3)) {
/* A null terminated filename */
while (*c != '\0') {
while ((c - compr) < comprlen && *c != '\0') {
c++;
}
@ -2903,7 +2903,7 @@ tvb_uncompress(tvbuff_t *tvb, int offset, int comprlen)
if (flags & (1 << 4)) {
/* A null terminated comment */
while (*c != '\0') {
while ((c - compr) < comprlen && *c != '\0') {
c++;
}