From cc7a52466d75f5bbbeda678d5efa0945d395d6e9 Mon Sep 17 00:00:00 2001
From: Jeff Morriss <jeff.morriss.ws@gmail.com>
Date: Thu, 24 Jan 2013 03:09:11 +0000
Subject: [PATCH 3/6] Copy over from trunk:

    ------------------------------------------------------------------------
    r47125 | martink | 2013-01-16 16:57:34 -0500 (Wed, 16 Jan 2013) | 2 lines

    no need for if (tree)

    ------------------------------------------------------------------------
    r47123 | martink | 2013-01-16 16:51:16 -0500 (Wed, 16 Jan 2013) | 5 lines

    don't attempt reassembly if more than 1000 consecutive fragments are
    missing

    this fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8222

    ------------------------------------------------------------------------
    r47098 | eapache | 2013-01-15 11:51:55 -0500 (Tue, 15 Jan 2013) | 5 lines

    Don't run past the end of a fragment array, either in the loop or by putting a
    useless sentinel in.

    Fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8213

svn path=/trunk-1.8/; revision=47245
---
 epan/dissectors/packet-dcp-etsi.c |   16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/epan/dissectors/packet-dcp-etsi.c b/epan/dissectors/packet-dcp-etsi.c
index 6ef4b80..9f9263c 100644
--- a/epan/dissectors/packet-dcp-etsi.c
+++ b/epan/dissectors/packet-dcp-etsi.c
@@ -243,6 +243,9 @@ gboolean rs_correct_data(guint8 *deinterleaved, guint8 *output,
 
 /* Don't attempt reassembly if we have a huge number of fragments. */
 #define MAX_FRAGMENTS ((1 * 1024 * 1024) / sizeof(guint32))
+/* If we missed more than this number of consecutive fragments,
+   we don't attempt reassembly */
+#define MAX_FRAG_GAP  1000
 
 static tvbuff_t *
 dissect_pft_fec_detailed(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree,
@@ -295,13 +298,11 @@ dissect_pft_fec_detailed(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree,
 
     /* make a list of the findex (offset) numbers of the fragments we have */
     fd = fragment_get(pinfo, seq, dcp_fragment_table);
-    for (fd_head = fd; fd_head != NULL; fd_head = fd_head->next) {
+    for (fd_head = fd; fd_head != NULL && fragments < fcount; fd_head = fd_head->next) {
       if(fd_head->data) {
         got[fragments++] = fd_head->offset; /* this is the findex of the fragment */
       }
     }
-    /* put a sentinel at the end */
-    got[fragments++] = fcount;
     /* have we got enough for Reed Solomon to try to correct ? */
     if(fragments>=rx_min) { /* yes, in theory */
       guint i,current_findex;
@@ -318,8 +319,13 @@ dissect_pft_fec_detailed(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree,
       for(i=0; i<fragments; i++) {
         guint next_fragment_we_have = got[i];
         if (next_fragment_we_have > MAX_FRAGMENTS) {
-          if (tree)
-            proto_tree_add_text(tree, tvb , 0, -1, "[Reassembly of %d fragments not attempted]", next_fragment_we_have);
+          proto_tree_add_text(tree, tvb , 0, -1, "[Reassembly of %d fragments not attempted]", next_fragment_we_have);
+          return NULL;
+        }
+        if (next_fragment_we_have-current_findex > MAX_FRAG_GAP) {
+          proto_tree_add_text(tree, tvb , 0, -1,
+              "[Missing %d consecutive packets. Don't attempt reassembly]",
+              next_fragment_we_have-current_findex);
           return NULL;
         }
         for(; current_findex<next_fragment_we_have; current_findex++) {
-- 
1.7.10.4

