Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Fwd: And again BER errors whiledecodingH248packets

Date: Mon, 25 Sep 2006 17:18:21 +0200
all that H.248  says about sequences is:

NOTE 2 – The ASN.1 specification below contains a clause defining
TerminationIDList as a
sequence of TerminationIDs. The length of this sequence SHALL be one,
except possibly when used in contextAuditResult.

Is that our case?

Luis.

On 9/25/06, Anders Broman (AL/EAB) <anders.broman@xxxxxxxxxxxx> wrote:

>On 9/25/06, ronnie sahlberg <ronniesahlberg@xxxxxxxxx> wrote:
>> Are these zero length constructs actually allowed by the standard?
>>
>> If they are not it might be better to just abort dissection completely
>> with a "[malformed packet]" message.

>I honestly do not know if the standard allows for that, however,
>I do not agree with aborting dissection en tout. I believe that if we
>can decode it we should, but an error label  (expert info) should be
>added to the item.
>
>Luis

If I remeber correctly the "BER" standard allows zero lengt SEQUENCE and SEQUENCE OF, I'm haven't checked if the H.248 standard
says anything on the subject.
It looks though like an "unusual" implementation :)

Brg
Anders

_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-dev





--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan