sFlow: Add a test capture file

[tcpdump] / smbutil.c

diff --git a/smbutil.c b/smbutil.c
index 52ffed4c87633e4e9f94cdac5f68136e2f2ace5d..a8203bf6a64959af17da4aad7cae0b384c433cd8 100644 (file)
--- a/smbutil.c
+++ b/smbutil.c
@@ -873,11 +873,26 @@ smb_fdata(netdissect_options *ndo,
     while (*fmt) {
        switch (*fmt) {
        case '*':
+           /*
+            * List of multiple instances of something described by the
+            * remainder of the string (which may itself include a list
+            * of multiple instances of something, so we recurse).
+            */
            fmt++;
            while (buf < maxbuf) {
                const u_char *buf2;
                depth++;
-               buf2 = smb_fdata(ndo, buf, fmt, maxbuf, unicodestr);
+               /*
+                * In order to avoid stack exhaustion recurse at most 10
+                * levels; that "should not happen", as no SMB structure
+                * should be nested *that* deeply, and we thus shouldn't
+                * have format strings with that level of nesting.
+                */
+               if (depth == 10) {
+                       ND_PRINT("(too many nested levels, not recursing)");
+                       buf2 = buf;
+               } else
+                       buf2 = smb_fdata(ndo, buf, fmt, maxbuf, unicodestr);
                depth--;
                if (buf2 == NULL)
                    return(NULL);
@@ -888,22 +903,35 @@ smb_fdata(netdissect_options *ndo,
            return(buf);
 
        case '|':
+           /*
+            * Just do a bounds check.
+            */
            fmt++;
            if (buf >= maxbuf)
                return(buf);
            break;
 
        case '%':
+           /*
+            * XXX - unused?
+            */
            fmt++;
            buf = maxbuf;
            break;
 
        case '#':
+           /*
+            * Done?
+            */
            fmt++;
            return(buf);
            break;
 
        case '[':
+           /*
+            * Format of an item, enclosed in square brackets; dissect
+            * the item with smb_fdata1().
+            */
            fmt++;
            if (buf >= maxbuf)
                return(buf);
@@ -931,6 +959,9 @@ smb_fdata(netdissect_options *ndo,
            break;
 
        default:
+           /*
+            * Not a formatting character, so just print it.
+            */
            ND_PRINT("%c", *fmt);
            fmt++;
            break;