From 5fe18f2f33e3f20cba0ba08ee1bd54a96184af2d Mon Sep 17 00:00:00 2001
From: Michael Mann <mmann78@netscape.net>
Date: Thu, 14 Feb 2013 19:42:58 +0000
Subject: [PATCH 2/7] Fix potential buffer overflow in RTPS and RTPS2
 dissectors by allocating enough memory to fit the
 "indentation space".

Bug 8332 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8332)

svn path=/trunk/; revision=47658
---
 epan/dissectors/packet-rtps.c  |    5 +++--
 epan/dissectors/packet-rtps2.c |    5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/epan/dissectors/packet-rtps.c b/epan/dissectors/packet-rtps.c
index 849f29a..08ef4b0 100644
--- a/epan/dissectors/packet-rtps.c
+++ b/epan/dissectors/packet-rtps.c
@@ -2028,7 +2028,7 @@ static gint rtps_util_add_typecode(proto_tree *tree,
   guint32 tk_id;
   guint16 tk_size;
   unsigned int i;
-  char    indent_string[40];
+  char*   indent_string;
   gint    retVal;
   char    type_name[40];
   
@@ -2041,7 +2041,8 @@ static gint rtps_util_add_typecode(proto_tree *tree,
      */
 
   /* Calc indent string */
-  memset(indent_string, ' ', 40);
+  indent_string = ep_alloc((indent_level*2)+1);
+  memset(indent_string, ' ', indent_level*2);
   indent_string[indent_level*2] = '\0';
   
   /* Gets TK ID */
diff --git a/epan/dissectors/packet-rtps2.c b/epan/dissectors/packet-rtps2.c
index 8d19c20..4b23c37 100644
--- a/epan/dissectors/packet-rtps2.c
+++ b/epan/dissectors/packet-rtps2.c
@@ -2302,7 +2302,7 @@ static gint rtps_util_add_typecode(proto_tree *tree,
   guint32 tk_id;
   guint16 tk_size;
   unsigned int i;
-  char    indent_string[40];
+  char*   indent_string;
   gint    retVal;
   char    type_name[40];
   
@@ -2315,7 +2315,8 @@ static gint rtps_util_add_typecode(proto_tree *tree,
      */
 
   /* Calc indent string */
-  memset(indent_string, ' ', 40);
+  indent_string = ep_alloc((indent_level*2)+1);
+  memset(indent_string, ' ', indent_level*2);
   indent_string[indent_level*2] = '\0';
   
   /* Gets TK ID */
-- 
1.7.10.4

