From a255d2cabfafd096a8a86f3e943a858ba1b8684a Mon Sep 17 00:00:00 2001
From: Evan Huus <eapache@gmail.com>
Date: Sun, 1 Sep 2013 12:57:43 +0000
Subject: [PATCH] Copy over revisions from the trunk:

  ------------------------------------------------------------------------
  r51213 | eapache | 2013-08-08 06:50:11 -0400 (Thu, 08 Aug 2013) | 4 lines

  Correctly check bounds on dim_max.

  Fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9019

  ------------------------------------------------------------------------

svn path=/trunk-1.8/; revision=51624

Conflicts:
	asn1/ldap/packet-ldap-template.c
	epan/dissectors/packet-ldap.c
---
 epan/dissectors/packet-rtps.c  |    5 +++++
 epan/dissectors/packet-rtps2.c |    5 +++++
 2 files changed, 10 insertions(+)

diff --git a/epan/dissectors/packet-rtps.c b/epan/dissectors/packet-rtps.c
index 08ef4b0..8a389bb 100644
--- a/epan/dissectors/packet-rtps.c
+++ b/epan/dissectors/packet-rtps.c
@@ -2525,6 +2525,11 @@ static gint rtps_util_add_typecode(proto_tree *tree,
         dim_max = NEXT_guint32(tvb, offset, little_endian);
         offset += 4;
 
+        if (dim_max > MAX_ARRAY_DIMENSION) {
+            /* We don't have a tree item to add expert info to... */
+            dim_max = MAX_ARRAY_DIMENSION;
+        }
+
         for (i = 0; i < MAX_ARRAY_DIMENSION; ++i) size[i] = 0;
         for (i = 0; i < dim_max; ++i) {
           size[i] = NEXT_guint32(tvb, offset, little_endian);
diff --git a/epan/dissectors/packet-rtps2.c b/epan/dissectors/packet-rtps2.c
index 4b23c37..17e39a1 100644
--- a/epan/dissectors/packet-rtps2.c
+++ b/epan/dissectors/packet-rtps2.c
@@ -2799,6 +2799,11 @@ static gint rtps_util_add_typecode(proto_tree *tree,
         dim_max = NEXT_guint32(tvb, offset, little_endian);
         offset += 4;
 
+        if (dim_max > MAX_ARRAY_DIMENSION) {
+            /* We don't have a tree item to add expert info to... */
+            dim_max = MAX_ARRAY_DIMENSION;
+        }
+
         for (i = 0; i < MAX_ARRAY_DIMENSION; ++i) size[i] = 0;
         for (i = 0; i < dim_max; ++i) {
           size[i] = NEXT_guint32(tvb, offset, little_endian);
-- 
1.7.10.4

