From cd09cb5cfb673beca3cce20b1d6a9bc67a134ae1 Mon Sep 17 00:00:00 2001 From: Gerald Combs Date: Mon, 7 Jan 2019 14:41:29 -0800 Subject: [PATCH] epan: Add a boundary check to get_t61_string. Add a boundary check to make sure we don't go past the end of "ptr". Bug: 15373 Change-Id: I85394e8e6e477b47919362af146051cc8911254b Reviewed-on: https://code.wireshark.org/review/31440 Reviewed-by: Gerald Combs --- epan/charsets.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/epan/charsets.c b/epan/charsets.c index 7f298fd..ebeb2dc 100644 --- a/epan/charsets.c +++ b/epan/charsets.c @@ -1382,7 +1382,7 @@ get_t61_string(wmem_allocator_t *scope, const guint8 *ptr, gint length) for (i = 0, c = ptr; i < length; c++, i++) { if (!t61_tab[*c]) { wmem_strbuf_append_unichar(strbuf, UNREPL); - } else if ((*c & 0xf0) == 0xc0) { + } else if (i < length - 1 && (*c & 0xf0) == 0xc0) { gint j = *c & 0x0f; /* If this is the end of the string, or if the base * character is just a space, treat this as a regular -- 2.7.4