Wireshark-dev: Re: [Wireshark-dev] How many tree items is too many?
From: "ronnie sahlberg" <[email protected]>
Date: Tue, 22 Aug 2006 20:24:20 +0000
i have several large DCERPC pdus that contain hundreds of thousands of
items when reassembled and dissected.



On 8/22/06, Gilbert Ramirez <[email protected]> wrote:
Make the limit high, to guard against infinite loops. Not too low, as
if we were trying to impose some design on the dissector. So even  a
number like 10,000 is good. That will guard against infinite loops,
and [hopefully] won't break a good dissector.

--gilbert

On 8/22/06, Gerald Combs <[email protected]> wrote:
> Would it make sense to place a maximum limit on the number of items in a
> protocol tree?  Right now, if a dissector tries to add a large number of
> items to the tree (e.g. during an infinite loop) Wireshark will happily
> oblige until the system runs out of memory.
>
> If so, what's a good number?  500? 1000?
> _______________________________________________
> Wireshark-dev mailing list
> [email protected]
> http://www.wireshark.org/mailman/listinfo/wireshark-dev
>
>
_______________________________________________
Wireshark-dev mailing list
[email protected]
http://www.wireshark.org/mailman/listinfo/wireshark-dev