diff options
| author | Michael Mann <mmann78@netscape.net> | 2017-01-24 23:06:04 -0500 |
|---|---|---|
| committer | Anders Broman <a.broman58@gmail.com> | 2017-01-28 03:45:52 +0000 |
| commit | ee185445f410b6bc54831ea0923af08cbcd75d00 (patch) | |
| tree | b742580224f55c97b9cf44ce509ef9eaf7e92bf4 | |
| parent | 77404250d53a4b123f05c834108e231a8885305a (diff) | |
| download | wireshark-ee185445f410b6bc54831ea0923af08cbcd75d00.tar.gz | |
rtmpt: Ensure sequence count is incremented for stored fragments
Bug: 13347
Change-Id: I351c80dea8ac7a9f2540b40782b1cc5c0b8fdaed
Reviewed-on: https://code.wireshark.org/review/19777
Reviewed-by: Anders Broman <a.broman58@gmail.com>
| -rw-r--r-- | epan/dissectors/packet-rtmpt.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/epan/dissectors/packet-rtmpt.c b/epan/dissectors/packet-rtmpt.c index 74e88f4e72..1b27f0914e 100644 --- a/epan/dissectors/packet-rtmpt.c +++ b/epan/dissectors/packet-rtmpt.c @@ -1876,6 +1876,7 @@ dissect_rtmpt_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, rtmpt_ guint8 cmd; guint32 src; int chunk_size; + guint32 save_seq = 0; rtmpt_frag_t *tf; rtmpt_id_t *ti; @@ -1898,8 +1899,9 @@ dissect_rtmpt_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, rtmpt_ wmem_stack_push(packets, 0); tp = (rtmpt_packet_t *)wmem_tree_lookup32_le(rconv->packets[cdir], seq+remain-1); - while (tp && tp->lastseq >= seq) { + while (tp && tp->lastseq >= seq && tp->lastseq >= save_seq) { wmem_stack_push(packets, tp); + save_seq = tp->lastseq+1; /* Ensure sequence is increasing */ tp = (rtmpt_packet_t *)wmem_tree_lookup32_le(rconv->packets[cdir], tp->lastseq-1); } |