diff options
| author | Evan Huus <eapache@gmail.com> | 2014-05-06 10:19:02 -0400 |
|---|---|---|
| committer | Evan Huus <eapache@gmail.com> | 2014-05-06 20:32:07 +0000 |
| commit | ec5ba0795aba38a3740c67e3d6d370e66ce9e916 (patch) | |
| tree | 52ebfabfabb148a17ff90b04a93864e368b14ea3 | |
| parent | d3a1cdea2cfe4967b8aca38bff02393543f60f90 (diff) | |
| download | wireshark-ec5ba0795aba38a3740c67e3d6d370e66ce9e916.tar.gz | |
Tweak ber_choice flow control.
There appear to be a couple of bugs in the flow control of this function (which
is very confusing), at least one of which is leading to a buffer overrun. See
the bug comments for more details and guesses of what the correct thing to do
is.
Bug:9579
Change-Id: Ibd3077792c7689a715ea53e8bf8c7a561c67389f
Reviewed-on: https://code.wireshark.org/review/1530
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Evan Huus <eapache@gmail.com>
| -rw-r--r-- | epan/dissectors/packet-ber.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/epan/dissectors/packet-ber.c b/epan/dissectors/packet-ber.c index c61352f0ec..7bf74a396b 100644 --- a/epan/dissectors/packet-ber.c +++ b/epan/dissectors/packet-ber.c @@ -2783,9 +2783,9 @@ printf("CHOICE dissect_ber_choice(%s) entered len:%d\n", name, tvb_length_remain if (branch_taken) { *branch_taken = -1; } + continue; } -choice_try_again: #ifdef DEBUG_BER_CHOICE printf("CHOICE testing potential subdissector class[%p]:%d:(expected)%d tag:%d:(expected)%d flags:%d\n", ch, ber_class, ch->ber_class, tag, ch->tag, ch->flags); #endif @@ -2887,7 +2887,7 @@ name = "unnamed"; printf("CHOICE dissect_ber_choice(%s) trying again\n", name); } #endif - goto choice_try_again; + continue; } if (!(ch->flags & BER_FLAGS_NOOWNTAG)) { if (ind) { |