Tight array index guard in packet-umts_fp.c

Fixes bug #9828.

Change-Id: I69b02a0d51921bae77850b599144f35a4fe9ee33
Reviewed-on: https://code.wireshark.org/review/560
Reviewed-by: Anders Broman <a.broman58@gmail.com>

diff --git a/epan/dissectors/packet-umts_fp.c b/epan/dissectors/packet-umts_fp.c
index d1b9428178d824a0a1b1f3214ebdbb467fc8b85e..36f615cee64a2764d999c9ba3cfbdde67f5379b1 100644 (file)
--- a/epan/dissectors/packet-umts_fp.c
+++ b/epan/dissectors/packet-umts_fp.c
@@ -3985,7 +3985,7 @@ fp_set_per_packet_inf_from_conv(umts_fp_conversation_info_t *p_conv_data,
                     }
                     tb_bit_off = (2+p_conv_data->num_dch_in_flow)*8;    /*Point to the C/T of first TB*/
                     /*Set configuration for individual blocks*/
-                    for(j=0; j < num_tbs; j++){
+                    for(j=0; j < num_tbs && j+chan < MAX_MAC_FRAMES; j++){
                         /*Set transport channel id (useful for debugging)*/
                         macinf->trchid[j+chan] = p_conv_data->dchs_in_flow_list[chan];