Fix several buffer and integer overflow issues discovered by Timo Sirainen.
authorGerald Combs <gerald@wireshark.org>
Mon, 28 Apr 2003 04:03:26 +0000 (04:03 -0000)
committerGerald Combs <gerald@wireshark.org>
Mon, 28 Apr 2003 04:03:26 +0000 (04:03 -0000)
commitb2f936ff24129c4f40b62f2a4a5410a24ad45ab4
tree44d90873362accb56c2c3d2eecab7c63e06ea5d9
parent4b4b030e514b884aaa0d50ba2fe5df830e78f5b0
Fix several buffer and integer overflow issues discovered by Timo Sirainen.

tvbuff.c:

  Lots of existing code assumes that you can safely do the following:

    #define MAX_BUF 64
    guint8 *buf[MAX_BUF];
    ...

    tvb_get_nstringz0 (tvb, offset, MAX_BUF, buf, &bytes_copied);

  In reality, tvb_get_nstringz*() can potentially write one byte past
  "buf".  Modify _tvb_get_nstringz() not to do that.

packet-ppp.c:

  Check for a valid BAP suboption length.

packet-mount.c:

  Fix a possible integer overflow in dissect_group().

svn path=/trunk/; revision=7590
epan/tvbuff.c
packet-mount.c
packet-ppp.c