http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=rev&revision=41057
User: guy
Date: 2012/02/17 04:01 PM
Log:
Don't trust the pointer value in a packet; it could be invalid, and this
could cause an unsigned length value to be reduced by more than its
value, turning it into a very large value.
This is, in effect, a backport of r41001 and r41002 to 1.6, although the
code path is different enough that it had to be done by hand. I don't
know whether bug 6833 would show up in 1.6, but, in any case, clearly
setting remaining_length to a negative number Would Be Wrong, so let's
not do that.
Directory: /trunk-1.6/epan/dissectors/
Changes Path Action
+16 -1 packet-mp2t.c Modified
