The spdy_assemble_data_frames() function in epan/dissectors/packet-spdy.c accumulates SPDY DATA frame payload fragment lengths into a uint32_t variable named datalen without any overflow protection. When the total accumulated fragment data exceeds 2^32 bytes (4,294,967,296), the datalen variable wraps to a small value. This wrapped value is then passed to wmem_alloc() as the allocation size, producing a buffer drastically smaller than the actual data. The subsequent memcpy() calls then write the full ~4.3 GB of attacker-controlled fragment data past the end of the tiny allocation, corrupting the heap.