Wireshark-dev: Re: [Wireshark-dev] malformed packet

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Mon, 07 Jul 2008 11:26:22 -0400

Martin Corraine (mcorrain) wrote:

Hello,

If I check a packet's header and size and return 0 because it wasn't my protocol (GED125), should I get the following message: "Malformed Packet: GED125"?

Probably not.

Are you sure it's actually returning 0 for that packet? It sounds like your dissector generated an exception (normally because it read beyond the end of a TVB). Maybe you need to check tvb_length() before the rest of your heuristic checks?