Wireshark-dev: Re: [Wireshark-dev] OpcUa update

From: Gerald Combs <gerald@xxxxxxxxxxxxx>
Date: Mon, 07 May 2007 10:37:57 -0700

Gerhard Gappmeier wrote:
> Hi,
> 
>> A fuzzed Sample.cap file (attached) crashed TShark and took a *very*
>> long time (2 mins) to load in WS.
>>
> it loads the file imediately on my computer without any delay.
> I tried the fuzzy file also with tshark.
> I called "tshark -r sample.cap", is this right?
> Because it didn't crash for me. I tried it several times.

You might try "tshark -rVx", which forces a packet detail hex dump
display for each packet.  If a bug is inside an "if (tree) { ... }"
block, then a simple "tshark -r" won't find it.