From Chris Maynard via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8360

Bail out if length is less than the minimum required length.

svn path=/trunk/; revision=47776

diff --git a/epan/dissectors/packet-hartip.c b/epan/dissectors/packet-hartip.c
index f92bd4257a53619efbaf9f6fa64d673af32fbdcb..4a84d82c7d1e383824dc665ec6901f70272c480c 100644 (file)
--- a/epan/dissectors/packet-hartip.c
+++ b/epan/dissectors/packet-hartip.c
@@ -857,7 +857,7 @@ dissect_hartip_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
 
   length  = tvb_get_ntohs(tvb, offset+6);
 
-  hart_item = proto_tree_add_item(tree, proto_hartip, tvb, 0, length, ENC_NA );
+  hart_item = proto_tree_add_item(tree, proto_hartip, tvb, 0, length, ENC_NA);
   hartip_tree = proto_item_add_subtree(hart_item, ett_hartip);
 
   ti = proto_tree_add_text(hartip_tree, tvb, offset, HARTIP_HEADER_LENGTH, "HART_IP Header");
@@ -904,6 +904,8 @@ dissect_hartip_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
   proto_tree_add_item(hdr_tree, hf_hartip_hdr_msg_length, tvb, offset, 2, ENC_BIG_ENDIAN);
   offset += 2;
 
+  if (length < HARTIP_HEADER_LENGTH)
+    return tvb_reported_length(tvb);
   bodylen = length - HARTIP_HEADER_LENGTH;
 
   /* add body elements. */