Wireshark · Ethereal-dev: [Ethereal-dev] Possible problem in packet-gtp [negative length tvb_memcpy()] ?

[Yaniv Kaul <ykaul@xxxxxxxxxxxx>]

In packet-gtp.c, is there a problem in the following routine, if length 
= 1 ?

decode_gtp_priv_ext(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, 
proto_tree *tree) {

   guint16        length, ext_id;
   gchar        ext_val[64];
   proto_tree    *ext_tree_priv_ext;
   proto_item    *te;

   te = proto_tree_add_text(tree, tvb, offset, 1, 
val_to_str(GTP_EXT_PRIV_EXT, gtp_val, "Unknown message"));
   ext_tree_priv_ext = proto_item_add_subtree(te, ett_gtp_ext);

   length = tvb_get_ntohs(tvb, offset+1);
   if (length < 1) return 3+length;

   ext_id = tvb_get_ntohs(tvb, offset+3);
   tvb_memcpy(tvb, ext_val, offset+5, length > 65 ? 63 : length-2);