Fix up a bunch of arguments to "dissect_ber_identifier()" to match its

[obnox/wireshark/wip.git] / epan / dissectors / packet-ndps.c

diff --git a/epan/dissectors/packet-ndps.c b/epan/dissectors/packet-ndps.c
index 6ea84aba9b2a88e83bf7b01db6d25b35d76128b1..4bf955a02dbbe0126d713704a9638ea852be4936 100644 (file)
--- a/epan/dissectors/packet-ndps.c
+++ b/epan/dissectors/packet-ndps.c
@@ -39,6 +39,8 @@
 #include <epan/reassemble.h>
 
 #define NDPS_PACKET_INIT_COUNT 200
+/* Limit the number of items we can add to the tree. */
+#define NDPS_MAX_ITEMS 50
 
 /* Tables for reassembly of fragments. */
 static GHashTable *ndps_fragment_table = NULL;
@@ -53,7 +55,7 @@ static guint32  tid = 1;
 static gboolean ndps_show_oids=FALSE;
 
 /* Global Attribute for evaluation of Values */
-static char *global_attribute_name=NULL;
+static const char *global_attribute_name=NULL;
 
 static void dissect_ndps_request(tvbuff_t*, packet_info*, proto_tree*, guint32, guint32, int);
 
@@ -1660,7 +1662,7 @@ static int
 objectidentifier(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
 {
     guint32     length;
-    char        *label=NULL;
+    const char  *label=NULL;
     guint32     label_value=0;
     proto_tree  *atree;
     proto_item  *aitem;
@@ -1805,6 +1807,7 @@ objectidentifier(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
         foffset += 1;
         length = tvb_get_guint8(tvb, foffset);
         foffset += 1;
+        tvb_ensure_bytes_exist(tvb, foffset, length);
         proto_tree_add_item(atree, hf_ndps_oid, tvb, foffset, length, FALSE);
         foffset += length;
     }
@@ -1812,6 +1815,7 @@ objectidentifier(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
     {
         if (!found) 
         {
+            tvb_ensure_bytes_exist(tvb, foffset, length);
             foffset += length;
         }
         else
@@ -1819,10 +1823,15 @@ objectidentifier(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 1;
             length = tvb_get_guint8(tvb, foffset);
             foffset += 1;
+            tvb_ensure_bytes_exist(tvb, foffset, length);
             foffset += length;
         }
     }
     global_attribute_name = label;
+    /* XXX - There's probably a better way to handle this */
+    if ((int) (foffset+(length%2)) < 0) {
+        THROW(ReportedBoundsError);
+    }
     return foffset+(length%2);
 }
 
@@ -1947,15 +1956,18 @@ print_address(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             proto_tree_add_item(ndps_tree, hf_ndps_net, tvb, foffset, 4, FALSE);
             proto_tree_add_item(ndps_tree, hf_ndps_node, tvb, foffset+4, 6, FALSE);
             proto_tree_add_item(ndps_tree, hf_ndps_socket, tvb, foffset+10, 2, FALSE);
+            tvb_ensure_bytes_exist(tvb, foffset, address_len);
             foffset += address_len;
             break;
     case 0x00000001:
             proto_tree_add_item(ndps_tree, hf_ndps_port, tvb, foffset, 2, FALSE);
             address = tvb_get_letohl(tvb, foffset+2);
             proto_tree_add_ipv4(ndps_tree, hf_ndps_ip, tvb, foffset+2, 4, address);
+            tvb_ensure_bytes_exist(tvb, foffset, address_len);
             foffset += address_len;
             break;
     default:
+        tvb_ensure_bytes_exist(tvb, foffset, tvb_get_ntohl(tvb, foffset -4));
         foffset += tvb_get_ntohl(tvb, foffset -4);
         break;
     }
@@ -2031,12 +2043,17 @@ credentials(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
         foffset += 4;
         for (i = 1 ; i <= number_of_items; i++ )
         {
+           if (i > NDPS_MAX_ITEMS) {
+               proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+               break;
+           }
             aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Password %d", i);
             atree = proto_item_add_subtree(aitem, ett_ndps);
             length = tvb_get_ntohl(tvb, foffset);
             foffset += 4;
             if (length!=0)
             {
+                tvb_ensure_bytes_exist(tvb, foffset, length);
                 proto_tree_add_item(atree, hf_ndps_password, tvb, foffset, length, FALSE);
             }
             proto_item_set_end(aitem, tvb, foffset);
@@ -2048,6 +2065,7 @@ credentials(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
         foffset += 4;
         if (length!=0)
         {
+            tvb_ensure_bytes_exist(tvb, foffset, length);
             proto_tree_add_item(ndps_tree, hf_ndps_certified, tvb, foffset, length, FALSE);
         }
         foffset += length;
@@ -2118,6 +2136,10 @@ event_object_set(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
     foffset += 4;
     for (i = 1 ; i <= number_of_items; i++ )
     {
+       if (i > NDPS_MAX_ITEMS) {
+           proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+           break;
+       }
         bitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Event %u", i);
         btree = proto_item_add_subtree(bitem, ett_ndps);
         proto_tree_add_item(btree, hf_ndps_event_type, tvb, foffset, 4, FALSE);
@@ -2144,6 +2166,10 @@ event_object_set(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
                 foffset += 4;
                 for (j = 1 ; j <= number_of_items2; j++ )
                 {
+                   if (j > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(btree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     citem = proto_tree_add_text(btree, tvb, foffset, -1, "Item %u", j);
                     ctree = proto_item_add_subtree(citem, ett_ndps);
                     foffset = objectidentifier(tvb, ctree, foffset);
@@ -2173,16 +2199,23 @@ cardinal_seq(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
     foffset += 4;
     for (i = 1 ; i <= number_of_items; i++ )
     {
+       if (i > NDPS_MAX_ITEMS) {
+           proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+           break;
+       }
         aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Cardinal %u", i);
         atree = proto_item_add_subtree(aitem, ett_ndps);
         length = tvb_get_ntohl(tvb, foffset);
         foffset += 4;
-        if (length!=0)
+        if (length==4)
         {
+            tvb_ensure_bytes_exist(tvb, foffset, length);
             proto_tree_add_item(atree, hf_ndps_attribute_value, tvb, foffset, length, FALSE);
         }
         foffset += length;
         foffset += (length%2);
+        if ((int) foffset <= 0)
+            THROW(ReportedBoundsError);
         proto_item_set_end(aitem, tvb, foffset);
     }
     return foffset;
@@ -2213,6 +2246,10 @@ server_entry(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
     foffset += 4;
     for (i = 1 ; i <= number_of_items; i++ )
     {
+       if (i > NDPS_MAX_ITEMS) {
+           proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+           break;
+       }
         bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Info %u", i);
         btree = proto_item_add_subtree(bitem, ett_ndps);
         data_type = tvb_get_ntohl(tvb, foffset);
@@ -2275,7 +2312,7 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
     guint32     dimension;
     guint32     location;
     guint32     cardinal;
-    char        *label;
+    const char  *label;
     guint32     label_value;
     proto_tree  *atree;
     proto_item  *aitem;
@@ -2322,6 +2359,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Item %d", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 foffset = name_or_id(tvb, atree, foffset);
@@ -2339,6 +2380,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Name %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 foffset = ndps_string(tvb, hf_object_name, atree, foffset, NULL, 0);
@@ -2357,7 +2402,8 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
         case 57:         /* Job Priority */
         case 72:         /* Sides */
         case 95:         /* Enumeration */
-            if (strcmp(global_attribute_name,"(Novell) Attribute PRINTER SECURITY LEVEL")==0)
+            if (global_attribute_name != NULL &&
+                strcmp(global_attribute_name,"(Novell) Attribute PRINTER SECURITY LEVEL")==0)
             {
                 proto_tree_add_item(ndps_tree, hf_print_security, tvb, foffset, 4, FALSE);
                 foffset += 4;
@@ -2372,8 +2418,9 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
         case 14:         /* Cardinal Seq */
             length = tvb_get_ntohl(tvb, foffset);
             foffset += 4;
-            if (length!=0)
+            if (length==4)
             {
+                tvb_ensure_bytes_exist(tvb, foffset, length);
                 proto_tree_add_item(ndps_tree, hf_info_int32, tvb, foffset, length, FALSE);
             }
             foffset += length;
@@ -2401,6 +2448,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Item %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 proto_tree_add_item(atree, hf_ndps_n64, tvb, foffset, 8, FALSE);
@@ -2438,6 +2489,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Object %d", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 foffset = objectidentifier(tvb, atree, foffset);
@@ -2450,6 +2505,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Name %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 foffset = ndps_string(tvb, hf_object_name, atree, foffset, NULL, 0);
@@ -2497,7 +2556,7 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
                 proto_tree_add_item(ndps_tree, hf_ndps_ydimension_n64, tvb, foffset, 8, FALSE);
                 foffset += 8;
             }
-            proto_tree_add_item(ndps_tree, hf_ndps_dim_flag, tvb, foffset, 8, FALSE);
+            proto_tree_add_item(ndps_tree, hf_ndps_dim_flag, tvb, foffset, 4, FALSE);
             foffset += 4;
             proto_tree_add_item(ndps_tree, hf_ndps_n64, tvb, foffset, 8, FALSE);
             foffset += 8;
@@ -2512,6 +2571,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Location %u", i);
                     atree = proto_item_add_subtree(aitem, ett_ndps);
                     proto_tree_add_item(atree, hf_ndps_n64, tvb, foffset, 8, FALSE);
@@ -2544,6 +2607,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Area %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 proto_tree_add_item(atree, hf_ndps_xmin_n64, tvb, foffset, 8, FALSE);
@@ -2613,7 +2680,7 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset = qualifiedname(tvb, ndps_tree, foffset);
             length = tvb_get_ntohl(tvb, foffset);
             foffset += 4;
-            if (length!=0)
+            if (length==4)
             {
                 proto_tree_add_item(ndps_tree, hf_ndps_attribute_value, tvb, foffset, length, FALSE);
             }
@@ -2627,6 +2694,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Address Item %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 foffset = address_item(tvb, atree, foffset);
@@ -2637,6 +2708,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Event %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 proto_tree_add_item(atree, hf_ndps_event_type, tvb, foffset, 4, FALSE);
@@ -2658,6 +2733,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
                         foffset += 4;
                         for (j = 1 ; j <= number_of_items2; j++ )
                         {
+                           if (j > NDPS_MAX_ITEMS) {
+                               proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                               break;
+                           }
                             foffset = objectidentifier(tvb, atree, foffset);
                         }
                         foffset += 4;
@@ -2673,6 +2752,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
                         foffset += 4;
                         for (j = 1 ; j <= number_of_items2; j++ )
                         {
+                           if (j > NDPS_MAX_ITEMS) {
+                               proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                               break;
+                           }
                             bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Object %u", i);
                             btree = proto_item_add_subtree(bitem, ett_ndps);
                             foffset = objectidentifier(tvb, btree, foffset);
@@ -2744,16 +2827,22 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Job %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 length = tvb_get_ntohl(tvb, foffset);
                 foffset += 4;
-                if (length!=0)
+                if (length==4)
                 {
                     proto_tree_add_item(atree, hf_ndps_attribute_value, tvb, foffset, length, FALSE);
                 }
                 foffset += length;
                 foffset += (length%2);
+                if ((int) foffset <= 0)
+                    THROW(ReportedBoundsError);
                 proto_item_set_end(aitem, tvb, foffset);
             }
             break;
@@ -2766,6 +2855,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Ignored Attribute %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 ignored_type = tvb_get_ntohl(tvb, foffset);
@@ -2809,6 +2902,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Resource %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 resource_type = tvb_get_ntohl(tvb, foffset);
@@ -2831,6 +2928,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Page Select %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 proto_tree_add_item(atree, hf_ndps_page_flag, tvb, foffset, 4, FALSE);
@@ -2888,6 +2989,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Item %u", i);
                     atree = proto_item_add_subtree(aitem, ett_ndps);
                     proto_tree_add_item(atree, hf_ndps_page_flag, tvb, foffset, 4, FALSE);
@@ -2926,6 +3031,8 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
                 }
                 foffset += length;
                 foffset += (length%2);
+                if ((int) foffset <= 0)
+                    THROW(ReportedBoundsError);
             }
             else
             {
@@ -3025,6 +3132,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Page Information %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 proto_tree_add_item(atree, hf_ndps_page_order, tvb, foffset, 4, FALSE);
@@ -3052,32 +3163,44 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Category %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 length = tvb_get_ntohl(tvb, foffset);
                 foffset += 4;
-                if (length!=0)
+                if (length==4)
                 {
                     proto_tree_add_item(atree, hf_ndps_attribute_value, tvb, foffset, length, FALSE);
                 }
                 foffset += length;
                 foffset += (length%2);
+                if ((int) foffset <= 0)
+                    THROW(ReportedBoundsError);
             }
             number_of_items = tvb_get_ntohl(tvb, foffset);
             proto_tree_add_uint(ndps_tree, hf_ndps_num_values, tvb, foffset, 4, number_of_items);
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Value %d", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 length = tvb_get_ntohl(tvb, foffset);
                 foffset += 4;
-                if (length!=0)
+                if (length==4)
                 {
                     proto_tree_add_item(atree, hf_ndps_attribute_value, tvb, foffset, length, FALSE);
                 }
                 foffset += length;
                 foffset += (length%2);
+                if ((int) foffset <= 0)
+                    THROW(ReportedBoundsError);
                 proto_item_set_end(aitem, tvb, foffset);
             }
             break;
@@ -3187,6 +3310,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Name %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 foffset = qualifiedname(tvb, atree, foffset);
@@ -3210,6 +3337,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Colorant %u", i);
                     atree = proto_item_add_subtree(aitem, ett_ndps);
                     foffset = name_or_id(tvb, atree, foffset);
@@ -3223,6 +3354,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Printer %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 foffset = ndps_string(tvb, hf_ndps_printer_type, atree, foffset, NULL, 0);
@@ -3271,6 +3406,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Object %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 foffset = ndps_string(tvb, hf_ndps_pa_name, atree, foffset, NULL, 0);
@@ -3284,6 +3423,7 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             if (length!=0)
             {
+                tvb_ensure_bytes_exist(tvb, foffset, length);
                 proto_tree_add_item(ndps_tree, hf_ndps_octet_string, tvb, foffset, length, FALSE);
             }
             foffset += length;
@@ -3292,16 +3432,20 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             if (length!=0)
             {
+                tvb_ensure_bytes_exist(tvb, foffset, length);
                 proto_tree_add_item(ndps_tree, hf_ndps_octet_string, tvb, foffset, length, FALSE);
             }
             foffset += length;
             foffset += (length%2);
+            if ((int) foffset <= 0)
+                THROW(ReportedBoundsError);
             break;
         case 107:         /* Octet String Integer Pair */
             length = tvb_get_ntohl(tvb, foffset);
             foffset += 4;
             if (length!=0)
             {
+                tvb_ensure_bytes_exist(tvb, foffset, length);
                 proto_tree_add_item(ndps_tree, hf_ndps_octet_string, tvb, foffset, length, FALSE);
             }
             foffset += length;
@@ -3321,6 +3465,7 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             if (length!=0)
             {
+                tvb_ensure_bytes_exist(tvb, foffset, length);
                 proto_tree_add_item(ndps_tree, hf_ndps_octet_string, tvb, foffset, length, FALSE);
             }
             foffset += length;
@@ -3343,10 +3488,13 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
                     foffset += 4;
                     if (length!=0)
                     {
+                        tvb_ensure_bytes_exist(tvb, foffset, length);
                         proto_tree_add_item(ndps_tree, hf_ndps_octet_string, tvb, foffset, length, FALSE);
                     }
                     foffset += length;
                     foffset += (length%2);
+                    if ((int) foffset <= 0)
+                        THROW(ReportedBoundsError);
                     break;
                 case 4:     /*DIST_NAME_STRING*/
                     foffset = ndps_string(tvb, hf_object_name, ndps_tree, foffset, NULL, 0);
@@ -3365,6 +3513,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Event %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 foffset = ndps_string(tvb, hf_object_name, atree, foffset, NULL, 0);
@@ -3380,6 +3532,10 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Object %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 foffset = objectidentifier(tvb, atree, foffset);
@@ -3417,6 +3573,10 @@ commonarguments(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
     foffset += 4;
     for (i = 1 ; i <= number_of_items; i++ )
     {
+       if (i > NDPS_MAX_ITEMS) {
+           proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+           break;
+       }
         bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Argument %u", i);
         btree = proto_item_add_subtree(bitem, ett_ndps);
         foffset = attribute_value(tvb, atree, foffset);
@@ -3844,6 +4004,12 @@ ndps_defrag(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
         /* Get request value data */
         request_value = p_get_proto_data(pinfo->fd, proto_ndps);
     }
+    if (!request_value)
+    {
+        /* Can't find the original request packet so this is not any fragment packet */
+        dissect_ndps(tvb, pinfo, tree);
+        return;
+    }
     /* Check to see of this is a fragment. If so then mark as a fragment. */
     if (!spx_info->eom) {
         request_value->ndps_frag = TRUE;
@@ -3864,6 +4030,8 @@ ndps_defrag(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
                 /* Is this the last fragment? EOM will indicate */
                 if (fd_head->next != NULL && spx_info->eom) 
                 {
+                    proto_item *frag_tree_item;
+
                     next_tvb = tvb_new_real_data(fd_head->data,
                         fd_head->len, fd_head->len);
                     tvb_set_child_real_data_tvbuff(tvb,
@@ -3877,7 +4045,7 @@ ndps_defrag(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
                         show_fragment_seq_tree(fd_head,
                             &ndps_frag_items,
                             tree, pinfo,
-                            next_tvb);
+                            next_tvb, &frag_tree_item);
                         tid++;
                     }
                     /* Remember this fragment number so we can dissect again */
@@ -4047,10 +4215,14 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Security %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 length = tvb_get_ntohl(tvb, foffset);
-                if (length!=0)
+                if (length==4)
                 {
                     proto_tree_add_uint(atree, hf_bind_security, tvb, foffset, 4, length);
                 }
@@ -4082,6 +4254,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Attribute %u", i);
                     btree = proto_item_add_subtree(bitem, ett_ndps);
                     foffset = objectidentifier(tvb, btree, foffset);
@@ -4090,6 +4266,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                     foffset += 4;
                     for (j = 1 ; j <= number_of_items2; j++ )
                     {
+                       if (j > NDPS_MAX_ITEMS) {
+                           proto_tree_add_text(btree, tvb, foffset, -1, "[Truncated]");
+                           break;
+                       }
                         citem = proto_tree_add_text(btree, tvb, foffset, -1, "Value %u", j);
                         ctree = proto_item_add_subtree(citem, ett_ndps);
                         foffset = attribute_value(tvb, ctree, foffset);
@@ -4107,6 +4287,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Type %u", i);
                     btree = proto_item_add_subtree(bitem, ett_ndps);
                     foffset = objectidentifier(tvb, btree, foffset);
@@ -4121,6 +4305,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Value %u", i);
                     btree = proto_item_add_subtree(bitem, ett_ndps);
                     if (doc_content==0)
@@ -4134,12 +4322,14 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                             proto_tree_add_item(btree, hf_ndps_data, tvb, foffset, -1, FALSE);
                             return;
                         }
-                        if (length!=0)
+                        if (length==4)
                         {
                             proto_tree_add_item(btree, hf_ndps_included_doc, tvb, foffset, length, FALSE);
                         }
                         foffset += length;
                         foffset += (length%2);
+                        if ((int) foffset <= 0)
+                            THROW(ReportedBoundsError);
                     }
                     else
                     {
@@ -4160,6 +4350,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Attribute %u", i);
                     btree = proto_item_add_subtree(bitem, ett_ndps);
                     foffset = objectidentifier(tvb, btree, foffset);
@@ -4168,6 +4362,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                     foffset += 4;
                     for (j = 1 ; j <= number_of_items2; j++ )
                     {
+                       if (j > NDPS_MAX_ITEMS) {
+                           proto_tree_add_text(btree, tvb, foffset, -1, "[Truncated]");
+                           break;
+                       }
                         citem = proto_tree_add_text(btree, tvb, foffset, -1, "Value %u", j);
                         ctree = proto_item_add_subtree(citem, ett_ndps);
                         foffset = attribute_value(tvb, ctree, foffset);
@@ -4185,6 +4383,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Attribute %u", i);
                     btree = proto_item_add_subtree(bitem, ett_ndps);
                     foffset = attribute_value(tvb, btree, foffset);  /* Document Attributes */
@@ -4204,6 +4406,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Method %u", i);
                     btree = proto_item_add_subtree(bitem, ett_ndps);
                     foffset = objectidentifier(tvb, btree, foffset); /* Transfer Method */
@@ -4219,6 +4425,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Type %u", i);
                     btree = proto_item_add_subtree(bitem, ett_ndps);
                     foffset = objectidentifier(tvb, btree, foffset); /* Document Type */
@@ -4233,6 +4443,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Attribute %u", i);
                     btree = proto_item_add_subtree(bitem, ett_ndps);
                     foffset = attribute_value(tvb, btree, foffset);  /* Document Attributes */
@@ -4264,6 +4478,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Modification %u", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 foffset = attribute_value(tvb, btree, foffset);  /* Job Modifications */
@@ -4277,6 +4495,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Modification %u", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 foffset = attribute_value(tvb, btree, foffset);  /* Document Modifications */
@@ -4323,6 +4545,7 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 foffset += 4;
                 if (length!=0)
                 {
+                    tvb_ensure_bytes_exist(tvb, foffset, length);
                     proto_tree_add_item(ndps_tree, hf_ndps_context, tvb, foffset, length, FALSE);
                 }
                 foffset += length;
@@ -4334,6 +4557,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Attribute %u", i);
                     atree = proto_item_add_subtree(aitem, ett_ndps);
                     foffset = attribute_value(tvb, atree, foffset);
@@ -4360,6 +4587,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                     foffset += 4;
                     for (i = 1 ; i <= number_of_items; i++ )
                     {
+                       if (i > NDPS_MAX_ITEMS) {
+                           proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                           break;
+                       }
                         bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Option %u", i);
                         btree = proto_item_add_subtree(bitem, ett_ndps);
                         foffset = objectidentification(tvb, btree, foffset);
@@ -4383,6 +4614,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                         foffset += 4;
                         for (i = 1 ; i <= number_of_items; i++ )
                         {
+                           if (i > NDPS_MAX_ITEMS) {
+                               proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                               break;
+                           }
                             foffset = filteritem(tvb, ndps_tree, foffset);
                         }
                         proto_item_set_end(aitem, tvb, foffset);
@@ -4400,6 +4635,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Attribute %u", i);
                     btree = proto_item_add_subtree(bitem, ett_ndps);
                     foffset = objectidentifier(tvb, btree, foffset);
@@ -4555,6 +4794,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Attribute %u", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 foffset = attribute_value(tvb, btree, foffset);  /* Object Attribute Set */
@@ -4613,6 +4856,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 /* Start of NWDPPrtContainedObjectId */
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Job ID");
                 btree = proto_item_add_subtree(bitem, ett_ndps);
@@ -4631,6 +4878,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 foffset += 4;
                 for (j = 1 ; j <= number_of_items2; j++ )
                 {
+                   if (j > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(btree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     citem = proto_tree_add_text(btree, tvb, foffset, -1, "Attribute %u", j);
                     ctree = proto_item_add_subtree(citem, ett_ndps);
                     foffset = attribute_value(tvb, ctree, foffset);  /* Object Attribute Set */
@@ -4646,6 +4897,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 foffset += 4;
                 for (j = 1 ; j <= number_of_items2; j++ )
                 {
+                   if (j > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(btree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     citem = proto_tree_add_text(btree, tvb, foffset, -1, "Attribute %u", j);
                     ctree = proto_item_add_subtree(citem, ett_ndps);
                     foffset = attribute_value(tvb, ctree, foffset);  /* Object Attribute Set */
@@ -4681,6 +4936,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Modification %d", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 foffset = attribute_value(tvb, btree, foffset);  /* Object Attribute Set */
@@ -4803,6 +5062,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Address %u", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 foffset = address_item(tvb, btree, foffset);
@@ -4832,10 +5095,11 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 length = tvb_get_ntohl(tvb, foffset);
                 foffset += 4;
-                if (length!=0)
+                if (length==4)
                 {
                     proto_tree_add_item(atree, hf_ndps_attribute_value, tvb, foffset, length, FALSE);
                 }
+                tvb_ensure_bytes_exist(tvb, foffset, length);
                 foffset += length;
                 proto_item_set_end(aitem, tvb, foffset);
             }
@@ -4922,6 +5186,7 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 foffset += 4;
                 if (length!=0)
                 {
+                    tvb_ensure_bytes_exist(tvb, foffset, length);
                     proto_tree_add_item(ndps_tree, hf_ndps_context, tvb, foffset, length, FALSE);
                 }
                 foffset += length;
@@ -4968,6 +5233,7 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             if (length!=0)
             {
+                tvb_ensure_bytes_exist(tvb, foffset, length);
                 proto_tree_add_item(ndps_tree, hf_ndps_guid, tvb, foffset, length, FALSE);
             }
             foffset += length;
@@ -5001,6 +5267,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Address %u", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 foffset = address_item(tvb, btree, foffset);
@@ -5020,6 +5290,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Attribute %u", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 foffset = objectidentifier(tvb, btree, foffset);
@@ -5090,6 +5364,7 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 foffset += 4;
                 if (length!=0)
                 {
+                    tvb_ensure_bytes_exist(tvb, foffset, length);
                     proto_tree_add_item(ndps_tree, hf_ndps_context, tvb, foffset, length, FALSE);
                 }
                 foffset += length;
@@ -5114,11 +5389,15 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Security %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 length = tvb_get_ntohl(tvb, foffset);
                 foffset += 4;
-                if (length!=0)
+                if (length==4)
                 {
                     proto_tree_add_item(atree, hf_bind_security, tvb, foffset, length, FALSE);
                 }
@@ -5141,10 +5420,15 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 length = tvb_get_ntohl(tvb, foffset);
                 foffset += 4;
                 if (length!=0)
                 {
+                    tvb_ensure_bytes_exist(tvb, foffset, length);
                     proto_tree_add_item(atree, hf_ndps_item_bytes, tvb, foffset, length, FALSE);
                 }
                 foffset += length;
@@ -5174,11 +5458,15 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Security %d", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 length = tvb_get_ntohl(tvb, foffset);
                 foffset += 4;
-                if (length!=0)
+                if (length==4)
                 {
                     proto_tree_add_item(atree, hf_bind_security, tvb, foffset, length, FALSE);
                 }
@@ -5208,6 +5496,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Entry %u", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 foffset = server_entry(tvb, btree, foffset);
@@ -5221,6 +5513,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Entry %u", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 foffset = server_entry(tvb, btree, foffset);
@@ -5254,6 +5550,7 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 foffset += 4;
                 if (length!=0)
                 {
+                    tvb_ensure_bytes_exist(tvb, foffset, length);
                     proto_tree_add_item(ndps_tree, hf_ndps_context, tvb, foffset, length, FALSE);
                 }
                 foffset += length;
@@ -5277,11 +5574,15 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Security %d", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 length = tvb_get_ntohl(tvb, foffset);
                 foffset += 4;
-                if (length!=0)
+                if (length==4)
                 {
                     proto_tree_add_item(atree, hf_bind_security, tvb, foffset, length, FALSE);
                 }
@@ -5302,6 +5603,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Supplier Alias %u", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 foffset = qualifiedname(tvb, atree, foffset);
@@ -5331,7 +5636,7 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             proto_item_set_end(aitem, tvb, foffset);
             length = tvb_get_ntohl(tvb, foffset);
             foffset += 4;
-            if (length!=0)
+            if (length==4)
             {
                 proto_tree_add_item(ndps_tree, hf_ndps_attribute_value, tvb, foffset, length, FALSE);
             }
@@ -5351,6 +5656,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             atree = proto_item_add_subtree(aitem, ett_ndps);
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Address %d", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 foffset = address_item(tvb, btree, foffset);
@@ -5380,10 +5689,11 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 length = tvb_get_ntohl(tvb, foffset);
                 foffset += 4;
-                if (length!=0)
+                if (length==4)
                 {
                     proto_tree_add_item(atree, hf_ndps_attribute_value, tvb, foffset, length, FALSE);
                 }
+                tvb_ensure_bytes_exist(tvb, foffset, length);
                 foffset += length;
                 proto_item_set_end(aitem, tvb, foffset);
             }
@@ -5470,6 +5780,7 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 foffset += 4;
                 if (length!=0)
                 {
+                    tvb_ensure_bytes_exist(tvb, foffset, length);
                     proto_tree_add_item(ndps_tree, hf_ndps_context, tvb, foffset, length, FALSE);
                 }
                 foffset += length;
@@ -5489,6 +5800,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             atree = proto_item_add_subtree(aitem, ett_ndps);
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Item %d", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 /* Start of ReportEventItem */
@@ -5525,6 +5840,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 ctree = proto_item_add_subtree(citem, ett_ndps);
                 for (j = 1 ; j <= number_of_items; j++ )
                 {
+                   if (j > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(ctree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     ditem = proto_tree_add_text(ctree, tvb, foffset, -1, "Modification %d", j);
                     dtree = proto_item_add_subtree(ditem, ett_ndps);
                     foffset = attribute_value(tvb, dtree, foffset);  /* Object Attribute Set */
@@ -5548,6 +5867,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Destination %d", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 /* Start of Destination */
@@ -5601,6 +5924,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             atree = proto_item_add_subtree(aitem, ett_ndps);
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Attribute %d", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 foffset = attribute_value(tvb, btree, foffset);  
@@ -5653,6 +5980,7 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 foffset += 4;
                 if (length!=0)
                 {
+                    tvb_ensure_bytes_exist(tvb, foffset, length);
                     proto_tree_add_item(ndps_tree, hf_ndps_context, tvb, foffset, length, FALSE);
                 }
                 foffset += length;
@@ -5690,11 +6018,15 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Security %d", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 length = tvb_get_ntohl(tvb, foffset);
                 foffset += 4;
-                if (length!=0)
+                if (length==4)
                 {
                     proto_tree_add_item(atree, hf_bind_security, tvb, foffset, length, FALSE);
                 }
@@ -5719,6 +6051,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Item %d", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 length=tvb_get_ntohl(tvb, foffset);
@@ -5874,6 +6210,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Item %d", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 proto_tree_add_item(atree, hf_ndps_session, tvb, foffset, 4, FALSE);
@@ -5882,7 +6222,7 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 length = tvb_get_ntohl(tvb, foffset);
                 foffset += 4;
-                if (length!=0)
+                if (length==4)
                 {
                     proto_tree_add_item(btree, hf_ndps_attribute_value, tvb, foffset, length, FALSE);
                 }
@@ -5931,6 +6271,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Object %d", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 proto_tree_add_item(atree, hf_ndps_session, tvb, foffset, 4, FALSE);
@@ -5939,7 +6283,7 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 length = tvb_get_ntohl(tvb, foffset);
                 foffset += 4;
-                if (length!=0)
+                if (length==4)
                 {
                     proto_tree_add_item(btree, hf_ndps_attribute_value, tvb, foffset, length, FALSE);
                 }
@@ -5979,6 +6323,10 @@ dissect_ndps_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, g
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(btree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     foffset = attribute_value(tvb, btree, foffset);  
                 }
                 proto_item_set_end(bitem, tvb, foffset);
@@ -6156,6 +6504,10 @@ ndps_error(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int foffset
         foffset += 4;
         for (i = 1 ; i <= number_of_items; i++ )
         {
+           if (i > NDPS_MAX_ITEMS) {
+               proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+               break;
+           }
             aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Item %d", i);
             atree = proto_item_add_subtree(aitem, ett_ndps);
             proto_tree_add_item(atree, hf_problem_type, tvb, foffset, 4, FALSE);
@@ -6368,6 +6720,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             atree = proto_item_add_subtree(aitem, ett_ndps);
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Attribute %d", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 foffset = attribute_value(tvb, btree, foffset);  /* Object Attribute Set */
@@ -6391,6 +6747,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Option %d", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 length=tvb_get_ntohl(tvb, foffset);
@@ -6420,6 +6780,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Result %d", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 foffset = objectidentification(tvb, btree, foffset);
@@ -6428,6 +6792,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
                 foffset += 4;
                 for (j = 1 ; j <= number_of_items2; j++ )
                 {
+                   if (j > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(btree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     citem = proto_tree_add_text(btree, tvb, foffset, -1, "Attribute %d", j);
                     ctree = proto_item_add_subtree(citem, ett_ndps);
                     foffset = objectidentifier(tvb, ctree, foffset);
@@ -6437,6 +6805,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
                     foffset += 4;
                     for (k = 1 ; k <= number_of_items3; k++ )
                     {
+                       if (k > NDPS_MAX_ITEMS) {
+                           proto_tree_add_text(ctree, tvb, foffset, -1, "[Truncated]");
+                           break;
+                       }
                         ditem = proto_tree_add_text(ctree, tvb, foffset, -1, "Value %d", k);
                         dtree = proto_item_add_subtree(ditem, ett_ndps);
                         foffset = attribute_value(tvb, dtree, foffset);
@@ -6475,6 +6847,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             atree = proto_item_add_subtree(aitem, ett_ndps);
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Attribute %d", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 foffset = attribute_value(tvb, btree, foffset);  /* Object Attribute Set */
@@ -6515,6 +6891,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             atree = proto_item_add_subtree(aitem, ett_ndps);
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Job %d", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 /* Start of NWDPPrtContainedObjectId */
@@ -6541,6 +6921,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
                 ctree = proto_item_add_subtree(citem, ett_ndps);
                 for (j = 1 ; j <= number_of_items2; j++ )
                 {
+                   if (j > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(ctree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     ditem = proto_tree_add_text(ctree, tvb, foffset, -1, "Object %d", j);
                     dtree = proto_item_add_subtree(ditem, ett_ndps);
                     foffset = attribute_value(tvb, dtree, foffset);  /* Object Attribute Set */
@@ -6566,6 +6950,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Object %d", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 foffset = attribute_value(tvb, btree, foffset);  /* Object Attribute Set */
@@ -6588,6 +6976,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Object %d", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 foffset = attribute_value(tvb, atree, foffset);  /* Object Attribute Set */
@@ -6611,7 +7003,7 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
         case 0x0000001d:    /* List Event Profiles */
             length = tvb_get_ntohl(tvb, foffset);
             foffset += 4;
-            if (length!=0)
+            if (length==4)
             {
                 proto_tree_add_item(ndps_tree, hf_ndps_attribute_value, tvb, foffset, length, FALSE);
             }
@@ -6626,7 +7018,7 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             foffset = qualifiedname(tvb, atree, foffset);
             length = tvb_get_ntohl(tvb, foffset);
             foffset += 4;
-            if (length!=0)
+            if (length==4)
             {
                 proto_tree_add_item(ndps_tree, hf_ndps_attribute_value, tvb, foffset, length, FALSE);
             }
@@ -6647,6 +7039,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Address %d", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 foffset = address_item(tvb, btree, foffset);
@@ -6659,6 +7055,7 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             foffset += 4;
             if (length!=0)
             {
+                tvb_ensure_bytes_exist(tvb, foffset, length);
                 proto_tree_add_item(ndps_tree, hf_ndps_continuation_option, tvb, foffset, length, FALSE);
             }
             foffset += length;
@@ -6693,6 +7090,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Event %d", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 /* Start of Eventhandling2 */
@@ -6721,6 +7122,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(btree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     citem = proto_tree_add_text(btree, tvb, foffset, -1, "Address %d", i);
                     ctree = proto_item_add_subtree(citem, ett_ndps);
                     foffset = address_item(tvb, ctree, foffset);
@@ -6740,6 +7145,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(btree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     citem = proto_tree_add_text(btree, tvb, foffset, -1, "Attribute %d", i);
                     ctree = proto_item_add_subtree(citem, ett_ndps);
                     foffset = objectidentifier(tvb, ctree, foffset);
@@ -6760,6 +7169,7 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
                 foffset += 4;
                 if (length!=0)
                 {
+                    tvb_ensure_bytes_exist(tvb, foffset, length);
                     proto_tree_add_item(ndps_tree, hf_ndps_continuation_option, tvb, foffset, length, FALSE);
                 }
                 foffset += length;
@@ -6789,6 +7199,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Service %d", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 proto_tree_add_item(atree, hf_ndps_service_type, tvb, foffset, 4, FALSE);
@@ -6821,12 +7235,17 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Attribute %d", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 length = tvb_get_ntohl(tvb, foffset);
                 foffset += 4;
                 if (length!=0)
                 {
+                    tvb_ensure_bytes_exist(tvb, foffset, length);
                     proto_tree_add_item(atree, hf_ndps_attribute_set, tvb, foffset, length, FALSE);
                 }
                 proto_item_set_end(aitem, tvb, foffset);
@@ -6849,6 +7268,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Item %d", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 foffset = server_entry(tvb, atree, foffset);
@@ -6858,6 +7281,7 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             foffset += 4;
             if (length!=0)
             {
+                tvb_ensure_bytes_exist(tvb, foffset, length);
                 proto_tree_add_item(ndps_tree, hf_ndps_continuation_option, tvb, foffset, length, FALSE);
             }
             foffset += length;
@@ -6869,6 +7293,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_item(ndps_tree, hf_ndps_client_server_type, tvb, foffset, 4, FALSE);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 foffset += 4;
@@ -6879,6 +7307,7 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             foffset += 4;
             if (length!=0)
             {
+                tvb_ensure_bytes_exist(tvb, foffset, length);
                 proto_tree_add_item(ndps_tree, hf_ndps_continuation_option, tvb, foffset, length, FALSE);
             }
             foffset += length;
@@ -6911,12 +7340,17 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Attribute %d", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
                 length = tvb_get_ntohl(tvb, foffset);
                 foffset += 4;
                 if (length!=0)
                 {
+                    tvb_ensure_bytes_exist(tvb, foffset, length);
                     proto_tree_add_item(atree, hf_ndps_attribute_set, tvb, foffset, length, FALSE);
                 }
                 proto_item_set_end(aitem, tvb, foffset);
@@ -6963,7 +7397,7 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             proto_item_set_end(aitem, tvb, foffset);
             length = tvb_get_ntohl(tvb, foffset);
             foffset += 4;
-            if (length!=0)
+            if (length==4)
             {
                 proto_tree_add_item(ndps_tree, hf_ndps_attribute_value, tvb, foffset, length, FALSE);
             }
@@ -6983,6 +7417,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Address %d", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 foffset = address_item(tvb, btree, foffset);
@@ -6996,6 +7434,7 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             foffset += 4;
             if (length!=0)
             {
+                tvb_ensure_bytes_exist(tvb, foffset, length);
                 proto_tree_add_item(ndps_tree, hf_ndps_continuation_option, tvb, foffset, length, FALSE);
             }
             foffset += length;
@@ -7005,7 +7444,7 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             /* Start of IntegerSeq */
             length = tvb_get_ntohl(tvb, foffset);
             foffset += 4;
-            if (length!=0)
+            if (length==4)
             {
                 proto_tree_add_item(ndps_tree, hf_ndps_language_id, tvb, foffset, length, FALSE);
             }
@@ -7029,6 +7468,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             foffset += 4;
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 /* Start of DeliveryMethod */
                 aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Method %d", i);
                 atree = proto_item_add_subtree(aitem, ett_ndps);
@@ -7071,6 +7514,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             atree = proto_item_add_subtree(aitem, ett_ndps);
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Address %d", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 foffset = address_item(tvb, btree, foffset);
@@ -7106,6 +7553,7 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             foffset += 4;
             if (length!=0)
             {
+                tvb_ensure_bytes_exist(tvb, foffset, length);
                 proto_tree_add_item(ndps_tree, hf_ndps_attribute_set, tvb, foffset, length, FALSE);
             }
             break;
@@ -7140,6 +7588,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Definition %d", i);
                     atree = proto_item_add_subtree(aitem, ett_ndps);
                     if (tvb_get_ntohl(tvb, foffset)==0) {  /* Offset for old type support */
@@ -7166,6 +7618,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Banner %d", i);
                     atree = proto_item_add_subtree(aitem, ett_ndps);
                     foffset = ndps_string(tvb, hf_ndps_banner_name, atree, foffset, NULL, 0);
@@ -7178,6 +7634,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Font %d", i);
                     atree = proto_item_add_subtree(aitem, ett_ndps);
                     foffset = ndps_string(tvb, hf_font_type_name, atree, foffset, NULL, 0);
@@ -7190,6 +7650,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Font File %d", i);
                     atree = proto_item_add_subtree(aitem, ett_ndps);
                     foffset = ndps_string(tvb, hf_font_file_name, atree, foffset, NULL, 0);
@@ -7204,6 +7668,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "File %d", i);
                     atree = proto_item_add_subtree(aitem, ett_ndps);
                     foffset = ndps_string(tvb, hf_ndps_prn_file_name, atree, foffset, NULL, 0);
@@ -7218,6 +7686,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Definition %d", i);
                     atree = proto_item_add_subtree(aitem, ett_ndps);
                     foffset = ndps_string(tvb, hf_ndps_prn_file_name, atree, foffset, NULL, 0);
@@ -7230,6 +7702,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Item %d", i);
                     atree = proto_item_add_subtree(aitem, ett_ndps);
                     foffset = ndps_string(tvb, hf_ndps_def_file_name, atree, foffset, NULL, 0);
@@ -7240,6 +7716,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
                     foffset += 4;
                     for (i = 1 ; i <= number_of_items2; i++ )
                     {
+                       if (i > NDPS_MAX_ITEMS) {
+                           proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                           break;
+                       }
                         foffset = ndps_string(tvb, hf_ndps_windows_key, btree, foffset, NULL, 0);
                     }
                     proto_item_set_end(bitem, tvb, foffset);
@@ -7250,6 +7730,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
                     foffset += 4;
                     for (i = 1 ; i <= number_of_items2; i++ )
                     {
+                       if (i > NDPS_MAX_ITEMS) {
+                           proto_tree_add_text(btree, tvb, foffset, -1, "[Truncated]");
+                           break;
+                       }
                         foffset = ndps_string(tvb, hf_ndps_windows_key, btree, foffset, NULL, 0);
                     }
                     proto_item_set_end(bitem, tvb, foffset);
@@ -7263,6 +7747,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "OS %d", i);
                     atree = proto_item_add_subtree(aitem, ett_ndps);
                     proto_tree_add_item(atree, hf_os_type, tvb, foffset, 4, FALSE);
@@ -7272,6 +7760,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
                     foffset += 4;
                     for (i = 1 ; i <= number_of_items2; i++ )
                     {
+                       if (i > NDPS_MAX_ITEMS) {
+                           proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                           break;
+                       }
                         bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Key %d", i);
                         btree = proto_item_add_subtree(bitem, ett_ndps);
                         foffset = ndps_string(tvb, hf_ndps_windows_key, btree, foffset, NULL, 0);
@@ -7288,6 +7780,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Type %d", i);
                     atree = proto_item_add_subtree(aitem, ett_ndps);
                     foffset = ndps_string(tvb, hf_ndps_printer_manuf, atree, foffset, NULL, 0);
@@ -7307,6 +7803,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
                 foffset += 4;
                 for (i = 1 ; i <= number_of_items; i++ )
                 {
+                   if (i > NDPS_MAX_ITEMS) {
+                       proto_tree_add_text(ndps_tree, tvb, foffset, -1, "[Truncated]");
+                       break;
+                   }
                     aitem = proto_tree_add_text(ndps_tree, tvb, foffset, -1, "Language %d", i);
                     atree = proto_item_add_subtree(aitem, ett_ndps);
                     proto_tree_add_item(atree, hf_ndps_language_id, tvb, foffset, 4, FALSE);
@@ -7402,6 +7902,10 @@ dissect_ndps_reply(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ndps_tree, int
             atree = proto_item_add_subtree(aitem, ett_ndps);
             for (i = 1 ; i <= number_of_items; i++ )
             {
+               if (i > NDPS_MAX_ITEMS) {
+                   proto_tree_add_text(atree, tvb, foffset, -1, "[Truncated]");
+                   break;
+               }
                 bitem = proto_tree_add_text(atree, tvb, foffset, -1, "Item %d", i);
                 btree = proto_item_add_subtree(bitem, ett_ndps);
                 length=tvb_get_ntohl(tvb, foffset);
@@ -7679,6 +8183,11 @@ proto_register_ndps(void)
           FT_UINT32,    BASE_HEX,   NULL,   0x0,
           "Document Number", HFILL }},
 
+        { &hf_ndps_doc_content,
+        { "Document Content",    "ndps.ndps_doc_content",
+          FT_UINT32,    BASE_HEX,   NULL,   0x0,
+          "Document Content", HFILL }},
+
         { &hf_ndps_nameorid,
         { "Name or ID Type",    "ndps.ndps_nameorid",
           FT_UINT32,    BASE_HEX,   VALS(nameorid_enum),   0x0,