Fix for bug 2098:

Test that message length is at least the minumum required, otherwise generate expert item..

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@23854 f5534014-38df-0310-8fa8-9805f1628bb7

diff --git a/plugins/unistim/packet-unistim.c b/plugins/unistim/packet-unistim.c
index c2f0407d75f0072795d0597d552c57294ce5661a..0895af17c2197c778beae06711cbfaa6094b3967 100644 (file)
--- a/plugins/unistim/packet-unistim.c
+++ b/plugins/unistim/packet-unistim.c
@@ -32,6 +32,7 @@
 #include <epan/packet.h>
 #include <epan/tap.h>
 #include <epan/emem.h>
+#include <epan/expert.h>
 #include <epan/address.h>
 #include <epan/dissectors/packet-rtp.h>
 #include <epan/dissectors/packet-rtcp.h>
@@ -410,8 +411,15 @@ dissect_unistim_message(proto_tree *unistim_tree,packet_info *pinfo,tvbuff_t *tv
    offset+=1;
    msg_len=tvb_get_guint8(tvb,offset);
 
-   proto_item_set_len(ti, msg_len);
-   proto_tree_add_item(msg_tree,hf_unistim_len,tvb,offset,1,FALSE);
+   if (msg_len<=2)
+   {
+     ti=proto_tree_add_item(msg_tree,hf_unistim_len,tvb,offset,1,FALSE);
+     expert_add_info_format(pinfo,ti,PI_MALFORMED,PI_ERROR,"Length too short");
+     return tvb_length(tvb);
+   } else {
+     proto_item_set_len(ti,msg_len);
+     proto_tree_add_item(msg_tree,hf_unistim_len,tvb,offset,1,FALSE);
+   }
 
    offset+=1;
    /*from switch*/