Fix an infinite loop in gsm_a dissector and a wrong offset in uma dissector.

This fixes bug 716.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@17119 f5534014-38df-0310-8fa8-9805f1628bb7

diff --git a/epan/dissectors/packet-gsm_a.c b/epan/dissectors/packet-gsm_a.c
index 2184afb7b288850970d3a03ffb706a0d662fe6fe..04bfeff343dbfefd9c4c47de92c330dbcafa2263 100644 (file)
--- a/epan/dissectors/packet-gsm_a.c
+++ b/epan/dissectors/packet-gsm_a.c
@@ -2384,10 +2384,10 @@ be_cell_id_aux(tvbuff_t *tvb, proto_tree *tree, guint32 offset, guint len, gchar
        break;
 
     default:
-       proto_tree_add_text(tree, tvb, curr_offset, len - 1,
+       proto_tree_add_text(tree, tvb, curr_offset, len,
            "Cell ID - Unknown format");
 
-       curr_offset += (len - 1);
+       curr_offset += (len);
        break;
     }
 

diff --git a/epan/dissectors/packet-uma.c b/epan/dissectors/packet-uma.c
index eaffc1f8ff05dfd9bc2af0891b089d6c98691321..8260a62f31a1a340fbe957ac1dd5ad912a030a3b 100644 (file)
--- a/epan/dissectors/packet-uma.c
+++ b/epan/dissectors/packet-uma.c
@@ -1035,7 +1035,7 @@ dissect_uma_IE(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset)
                /* Cell Identifier List 
                 * The rest of the IE is coded as in [TS 48.008], not including IEI and length, if present
                 */
-               be_cell_id_list(tvb, urr_ie_tree, offset, ie_len, NULL, 0);
+               be_cell_id_list(tvb, urr_ie_tree, ie_offset, ie_len, NULL, 0);
                break;
        case 16:                /* TU3907 Timer */
                proto_tree_add_item(urr_ie_tree, hf_uma_urr_TU3907_timer, tvb, ie_offset, 2, FALSE);