diff options
| author | Evan Huus <eapache@gmail.com> | 2013-10-10 23:59:57 +0000 |
|---|---|---|
| committer | Evan Huus <eapache@gmail.com> | 2013-10-10 23:59:57 +0000 |
| commit | 2ed259ccbce77508ee4b55743bcc2b063fbbe89b (patch) | |
| tree | bc635a9d916a981663776be68b9c9ce0d14de0a9 | |
| parent | e5336d281b29c69430fd4d4ab1ea425a7dddf6d9 (diff) | |
| download | wireshark-2ed259ccbce77508ee4b55743bcc2b063fbbe89b.tar.gz | |
When TCP options are truncated, we only add the truncated length to the tree,
not the whole length. Fixes an invalid access with the capture from
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9263
svn path=/trunk/; revision=52523
| -rw-r--r-- | epan/dissectors/packet-tcp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/epan/dissectors/packet-tcp.c b/epan/dissectors/packet-tcp.c index c0bc2121ad..2a3c16f97c 100644 --- a/epan/dissectors/packet-tcp.c +++ b/epan/dissectors/packet-tcp.c @@ -4575,7 +4575,7 @@ dissect_tcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) guint8 *p_options = (guint8 *)tvb_memdup(wmem_packet_scope(), tvb, offset + 20, bc); tf = proto_tree_add_bytes_format(tcp_tree, hf_tcp_options, tvb, offset + 20, - optlen, p_options, "Options: (%u bytes but truncated to %u bytes)", optlen, bc); + bc, p_options, "Options: (%u bytes but truncated to %u bytes)", optlen, bc); optlen = bc; } else { optlen = 0; |