Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Fwd: And again BER errors whiledecodingH248packets

From: "Anders Broman \(AL/EAB\)" <anders.broman@xxxxxxxxxxxx>
Date: Mon, 25 Sep 2006 15:34:05 +0200
>On 9/25/06, ronnie sahlberg <ronniesahlberg@xxxxxxxxx> wrote:
>> Are these zero length constructs actually allowed by the standard?
>>
>> If they are not it might be better to just abort dissection completely
>> with a "[malformed packet]" message.

>I honestly do not know if the standard allows for that, however,
>I do not agree with aborting dissection en tout. I believe that if we
>can decode it we should, but an error label  (expert info) should be
>added to the item.
>
>Luis

If I remeber correctly the "BER" standard allows zero lengt SEQUENCE and SEQUENCE OF, I'm haven't checked if the H.248 standard
says anything on the subject.
It looks though like an "unusual" implementation :)

Brg
Anders

<<winmail.dat>>