dcerpc: Check dissect_ndr_ucvarray_core when looping over elements that we're increme...

Bug: 12720
Change-Id: Ib9c9eb2e60c35b23b4c6b4898b036bcdc442fc84
Reviewed-on: https://code.wireshark.org/review/17041
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

diff --git a/epan/dissectors/packet-dcerpc.c b/epan/dissectors/packet-dcerpc.c
index b1d8cebe198ab52e5fa9bede040ac02e93ee9de1..750f7ed6d18d5d22a8a5cc7db66505de3d750810 100644 (file)
--- a/epan/dissectors/packet-dcerpc.c
+++ b/epan/dissectors/packet-dcerpc.c
@@ -2414,7 +2414,11 @@ dissect_ndr_ucvarray_core(tvbuff_t *tvb, gint offset, packet_info *pinfo,
                                        pinfo, tree, di, drep);
         } else if (fnct_bytes) {
             for (i=0 ;i<di->array_actual_count; i++) {
+                old_offset = offset;
                 offset = (*fnct_bytes)(tvb, offset, pinfo, tree, di, drep);
+                /* Make sure we're moving forward */
+                if (old_offset >= offset)
+                    break;
             }
         }
     }