From 793ca39dbc7813460e70cbdca92bbdf2ecb676b6 Mon Sep 17 00:00:00 2001
From: Gerald Combs <gerald@wireshark.org>
Date: Tue, 29 Oct 2013 19:55:46 +0000
Subject: [PATCH] Copy over r52570 with manual intervention:

  ------------------------------------------------------------------------
  r52570 | cmaynard | 2013-10-12 11:03:34 -0700 (Sat, 12 Oct 2013) | 4 lines
  Changed paths:
     M /trunk/epan/dissectors/packet-tcp.c

  Don't assume that tvb_length_remaining() or tvb_reported_length_remaining() always return a value >= 0.  Part of fix for https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9263

  #BACKPORT(1.10,1.8)
  ------------------------------------------------------------------------

Update the release notes.

svn path=/trunk-1.8/; revision=52962

Conflicts:
	epan/dissectors/packet-tcp.c
---
 epan/dissectors/packet-tcp.c |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/epan/dissectors/packet-tcp.c b/epan/dissectors/packet-tcp.c
index 100e299..ceadbd9 100644
--- a/epan/dissectors/packet-tcp.c
+++ b/epan/dissectors/packet-tcp.c
@@ -1591,7 +1591,7 @@ again:
 		*/
 		if(msp->flags&MSP_FLAGS_REASSEMBLE_ENTIRE_SEGMENT){
 			/* The dissector asked for the entire segment */
-			len=tvb_length_remaining(tvb, offset);
+			len = MAX(0, tvb_length_remaining(tvb, offset));
 		} else {
 			len=MIN(nxtseq, msp->nxtpdu) - seq;
 		}
@@ -1737,7 +1737,7 @@ again:
 					 * will complete reassembly even if it
 					 * is only one single byte in length.
 					 */
-					msp->nxtpdu=seq+tvb_reported_length_remaining(tvb, offset) + 1;
+					msp->nxtpdu=seq + MAX(0, tvb_reported_length_remaining(tvb, offset)) + 1;
 					msp->flags|=MSP_FLAGS_REASSEMBLE_ENTIRE_SEGMENT;
 				} else {
 					msp->nxtpdu=seq + last_fragment_len + pinfo->desegment_len;
@@ -1758,7 +1758,7 @@ again:
 				 */
 				nbytes = another_pdu_follows > 0
 					? another_pdu_follows
-					: tvb_reported_length_remaining(tvb, offset);
+					: MAX(0, tvb_reported_length_remaining(tvb, offset));
 				proto_tree_add_text(tcp_tree, tvb, offset, nbytes,
 				    "TCP segment data (%u byte%s)", nbytes,
 				    plurality(nbytes, "", "s"));
@@ -1913,7 +1913,7 @@ again:
 		 * XXX - remember what protocol the last subdissector
 		 * was, and report it as a continuation of that, instead?
 		 */
-		nbytes = tvb_reported_length_remaining(tvb, deseg_offset);
+		nbytes = MAX(0, tvb_reported_length_remaining(tvb, deseg_offset));
 		proto_tree_add_text(tcp_tree, tvb, deseg_offset, -1,
 		    "TCP segment data (%u byte%s)", nbytes,
 		    plurality(nbytes, "", "s"));
@@ -2051,7 +2051,7 @@ tcp_dissect_pdus(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
      */
     if(!pinfo->fd->flags.visited && tcp_analyze_seq){
        guint remaining_bytes;
-       remaining_bytes=tvb_reported_length_remaining(tvb, offset);
+       remaining_bytes = MAX(0, tvb_reported_length_remaining(tvb, offset));
        if(plen>remaining_bytes){
           pinfo->want_pdu_tracking=2;
           pinfo->bytes_until_next_pdu=plen-remaining_bytes;
@@ -3542,7 +3542,7 @@ dissect_tcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 
   /* Check the packet length to see if there's more data
      (it could be an ACK-only packet) */
-  length_remaining = tvb_length_remaining(tvb, offset);
+  length_remaining = MAX(0, tvb_length_remaining(tvb, offset));
 
   if (tcph->th_have_seglen) {
     if( data_out_file ) {
-- 
1.7.10.4

