diff options
| author | Gilbert Ramirez <gram@alumni.rice.edu> | 1999-01-12 17:44:52 +0000 |
|---|---|---|
| committer | Gilbert Ramirez <gram@alumni.rice.edu> | 1999-01-12 17:44:52 +0000 |
| commit | b918a92be2dd9ab8230b67bd3d4a3785b19d3428 (patch) | |
| tree | 47554570fcd9c69127a1df0722aa29704826e1f6 /packet-trmac.c | |
| parent | aee34fd33dfa2fc47fa65492004a50029284691e (diff) | |
| download | wireshark-b918a92be2dd9ab8230b67bd3d4a3785b19d3428.tar.gz wireshark-b918a92be2dd9ab8230b67bd3d4a3785b19d3428.tar.bz2 wireshark-b918a92be2dd9ab8230b67bd3d4a3785b19d3428.zip | |
Fixed a bug regarding bad packets. If a sub-vector indicated a 0-length,
dissect_trmac() would spin in an infinite loop. Now that condition is checked
and properly handled.
svn path=/trunk/; revision=168
Diffstat (limited to 'packet-trmac.c')
| -rw-r--r-- | packet-trmac.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/packet-trmac.c b/packet-trmac.c index 2ef6974ff8..7b95141444 100644 --- a/packet-trmac.c +++ b/packet-trmac.c @@ -2,7 +2,7 @@ * Routines for Token-Ring Media Access Control * Gilbert Ramirez <gram@verdict.uthscsa.edu> * - * $Id: packet-trmac.c,v 1.8 1998/11/17 04:29:06 gerald Exp $ + * $Id: packet-trmac.c,v 1.9 1999/01/12 17:44:52 gram Exp $ * * Ethereal - Network traffic analyzer * By Gerald Combs <gerald@unicom.net> @@ -258,7 +258,7 @@ void dissect_trmac(const u_char *pd, int offset, frame_data *fd, GtkTree *tree) { GtkWidget *mac_tree = NULL, *ti; - int mv_length, sv_length, sv_offset; + int mv_length, sv_length, sv_offset, sv_additional; char *class[] = { "Ring Station", "LLC Manager", "", "", "Configuration Report Server", "Ring Parameter Server", "Ring Error Monitor" }; @@ -301,8 +301,15 @@ dissect_trmac(const u_char *pd, int offset, frame_data *fd, GtkTree *tree) { offset += 4; sv_length = mv_length - 4; while (sv_offset < sv_length) { - sv_offset += sv_text(&pd[offset + sv_offset], offset + sv_offset, + sv_additional = sv_text(&pd[offset + sv_offset], offset + sv_offset, mac_tree); + + /* if this is a bad packet, we could get a 0-length added here, + * looping forever */ + if (sv_additional) + sv_offset += sv_additional; + else + break; } } } |