diff options
| -rw-r--r-- | epan/dissectors/packet-cip.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/epan/dissectors/packet-cip.c b/epan/dissectors/packet-cip.c index 236fee2499..8b2b2ff9f9 100644 --- a/epan/dissectors/packet-cip.c +++ b/epan/dissectors/packet-cip.c @@ -405,6 +405,9 @@ add_byte_array_text_to_proto_tree( proto_tree *tree, tvbuff_t *tvb, gint start, tmp2_length = ( length * 2 ) + 1; } + + /* Throw an exception if tmp_length is negative */ + tvb_ensure_bytes_exist( tvb, start, tmp_length ); tmp = tvb_get_ptr( tvb, start, tmp_length ); tmp2 = (char*)ep_alloc( tmp2_length ); @@ -1053,7 +1056,7 @@ dissect_cip_data( proto_tree *item_tree, tvbuff_t *tvb, int offset, int item_len /* Add reply status to info column */ if(check_col(pinfo->cinfo, COL_INFO)) { - col_append_str( pinfo->cinfo, COL_INFO, + col_append_str( pinfo->cinfo, COL_INFO, val_to_str( ( tvb_get_guint8( tvb, offset+2 ) ), cip_gs_vals , "Unknown Response (%x)") ); } @@ -1304,7 +1307,7 @@ dissect_cip_data( proto_tree *item_tree, tvbuff_t *tvb, int offset, int item_len /* Add service to info column */ if(check_col(pinfo->cinfo, COL_INFO)) { - col_append_str( pinfo->cinfo, COL_INFO, + col_append_str( pinfo->cinfo, COL_INFO, val_to_str( ( tvb_get_guint8( tvb, offset ) & 0x7F ), cip_sc_vals , "Unknown Service (%x)") ); } |