From 75677e4d9e6053c5066ac1ece5f644dd7c13ccab Mon Sep 17 00:00:00 2001
From: Balint Reczey <balint.reczey@ericsson.com>
Date: Wed, 18 Jul 2012 15:14:45 +0000
Subject: [PATCH] Fix crash in PPP dissector

Make sure that there is enough space allocated for PPP encapsulated CRTP
packet's header.
The bug can be triggered on an x86_64 system using the cpature file attached to
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=680056

svn path=/trunk/; revision=43784
---
 epan/dissectors/packet-ppp.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/epan/dissectors/packet-ppp.c b/epan/dissectors/packet-ppp.c
index 54ab946..7fe9455 100644
--- a/epan/dissectors/packet-ppp.c
+++ b/epan/dissectors/packet-ppp.c
@@ -3324,6 +3324,11 @@ dissect_iphc_crtp_fh(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 
     /* allocate a copy of the IP packet */
     ip_packet = tvb_memdup(tvb, 0, length);
+    /*
+     * make sure that we will be able to write the write the length information
+     * to the copy at least
+     */
+    tvb_ensure_bytes_exist (tvb, ip_hdr_len, 5);
 
     /* restore the proper values to the IP and UDP length fields */
     ip_packet[2] = length >> 8;
-- 
1.7.2.5

