Based on initial patch by Michal Labedzki

Don't return a negative value from get_type_length, it can get us into bad
loops. Fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8831

svn path=/trunk/; revision=50134

diff --git a/epan/dissectors/packet-btsdp.c b/epan/dissectors/packet-btsdp.c
index 642861e6eb78e79e9de4a20085a9bc16adf82656..fd346532814c1c29d33ce28d698685ac8ba88984 100644 (file)
--- a/epan/dissectors/packet-btsdp.c
+++ b/epan/dissectors/packet-btsdp.c
@@ -1003,7 +1003,13 @@ get_type_length(tvbuff_t *tvb, gint offset, gint *length)
         break;
     }
 
-    *length = size;
+    if (size < 0) {
+        *length = 0; /* Add expert info? */
+    }
+    else {
+        *length = size;
+    }
+
     return offset;
 }