On Aug 10, 2009, at 3:41 PM, Bill Meier wrote: > [email protected] wrote: > >> don't give up, as we'll just skip the bad item and move on to >> the next item. >> > > The dissector "skips to the next" using the bad tag length so I > thought > it better to not try to keep on dissecting.
For a fuzzed file, it'll report a bunch of bad TLVs, as it'll skip to the wrong offset. The dissection will be ugly, but it shouldn't crash. For a capture of traffic from a device that's putting out values that aren't 2 bytes long for those TLVs, but where the length field is consistent with the wrong-length value, it'll skip to the right offset. ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
