Re: [Wireshark-dev] Fwd: And again BER errors while decodingH248packets

2006-09-25 Thread ronnie sahlberg
Are these zero length constructs actually allowed by the standard?

If they are not it might be better to just abort dissection completely
with a [malformed packet] message.




On 9/25/06, Anders Broman (AL/EAB) [EMAIL PROTECTED] wrote:

 Hi,
 Well there is one item of Zero length :)

 Which may not be so easy to fix.
 Brg
 Anders

 -Original Message-
 From: [EMAIL PROTECTED] on behalf of Oleg Kostenko
 Sent: Mon 9/25/2006 11:09 AM
 To: Anders Broman; wireshark-dev@wireshark.org
 Subject: Re: [Wireshark-dev] Fwd: And again BER errors while
 decodingH248packets

 Hello Anders,

 BER errors are gone, but now some lines tell that there is '1 item' f
 something, while actually there isn't:

 ...
 Item: mediaDescriptor (1)
   mediaDescriptor
 termStateDescr
 here: propertyParms: 1 item
   serviceState: inSvc (2)
 streams: oneStream (0)
   oneStream
 localControlDescriptor
   reserveValue: False
   reserveGroup: False
 here: propertyParms: 1 item
 Item: eventsDescriptor (4)
   eventsDescriptor
 requestID: 0
 here:   eventList: 1 item
 ...

 --
 Best regards,
  Olegmailto:[EMAIL PROTECTED]


 Monday, September 25, 2006, 1:08:29 AM, you wrote:

 AB Hi,
 AB I have checked in a fix please verify it with your traces.

 AB Best regards
 AB Anders

 AB -Ursprungligt meddelande-
 AB Från: Oleg Kostenko [mailto:[EMAIL PROTECTED]
 AB Skickat: den 20 september 2006 10:41
 AB Till: Anders Broman; wireshark-dev@wireshark.org
 AB Ämne: Re[2]: Fwd: And again BER errors while decoding H248packets

 AB Hello Anders,

 AB Here is the fragment from the ASN.1 specification for H.248.

 AB TerminationStateDescriptor ::= SEQUENCE
 AB {
 AB   propertyParms   SEQUENCE OF PropertyParm,
 AB   eventBufferControl  EventBufferControl OPTIONAL,
 AB   serviceStateServiceState OPTIONAL,
 AB   ...
 AB }

 AB As I understand, SEQUENCE OF means zero or more elements, so it is
 AB possible that there will be no propertyParms at all. So in terms of
 AB ASN.1 the packet is correct and no BER errors should occur. Right?

 ___
 Wireshark-dev mailing list
 Wireshark-dev@wireshark.org
 http://www.wireshark.org/mailman/listinfo/wireshark-dev


___
Wireshark-dev mailing list
Wireshark-dev@wireshark.org
http://www.wireshark.org/mailman/listinfo/wireshark-dev


Re: [Wireshark-dev] Fwd: And again BER errors while decodingH248packets

2006-09-25 Thread LEGO
On 9/25/06, ronnie sahlberg [EMAIL PROTECTED] wrote:
 Are these zero length constructs actually allowed by the standard?

 If they are not it might be better to just abort dissection completely
 with a [malformed packet] message.

I honestly do not know if the standard allows for that, however,
I do not agree with aborting dissection en tout. I believe that if we
can decode it we should, but an error label  (expert info) should be
added to the item.

Luis



-- 
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan
___
Wireshark-dev mailing list
Wireshark-dev@wireshark.org
http://www.wireshark.org/mailman/listinfo/wireshark-dev