Check for an integer overflow. Fixes bug 149.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@14245 f5534014-38df-0310-8fa8-9805f1628bb7

diff --git a/epan/dissectors/packet-ndps.c b/epan/dissectors/packet-ndps.c
index 974e2a82f54f295afadc55ea14520e005e3ad2d9..65992badc38914979bfd25c71a22e84608216937 100644 (file)
--- a/epan/dissectors/packet-ndps.c
+++ b/epan/dissectors/packet-ndps.c
@@ -3185,6 +3185,8 @@ attribute_value(tvbuff_t* tvb, proto_tree *ndps_tree, int foffset)
                 }
                 foffset += length;
                 foffset += (length%2);
+                if ((int) foffset <= 0)
+                    THROW(ReportedBoundsError);
                 proto_item_set_end(aitem, tvb, foffset);
             }
             break;