From Jeff Morriss:
authoretxrab <etxrab@f5534014-38df-0310-8fa8-9805f1628bb7>
Thu, 23 Feb 2012 08:40:23 +0000 (08:40 +0000)
committeretxrab <etxrab@f5534014-38df-0310-8fa8-9805f1628bb7>
Thu, 23 Feb 2012 08:40:23 +0000 (08:40 +0000)
H223: Buildbot crash output: fuzz-2012-01-25-22599.pcap

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6768

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@41148 f5534014-38df-0310-8fa8-9805f1628bb7

epan/dissectors/packet-h223.c

index c71f6bb..5f24bd5 100644 (file)
@@ -825,14 +825,14 @@ dissect_mux_sdu_fragment(tvbuff_t *volatile next_tvb, packet_info *pinfo,
 static guint32
 mux_element_sublist_size( h223_mux_element* me )
 {
-    h223_mux_element *current_me = me;
+    h223_mux_element *current_me = me->next;
     guint32 length = 0;
     while ( current_me ) {
-        current_me = current_me->next;
         if ( current_me->sublist )
             length += current_me->repeat_count * mux_element_sublist_size( current_me->sublist );
         else
             length += current_me->repeat_count;
+        current_me = current_me->next;
     }
     if ( length == 0 ) { /* should never happen, but to avoid infinite loops... */
         DISSECTOR_ASSERT_NOT_REACHED();