Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Malformed packets in CORBA protocol plugin

Date: Wed, 13 Dec 2006 22:33:34 +0000



-----Guy Harris <guy@xxxxxxxxxxxx> wrote: -----

>> Can anyone see any problem with this?
>
>1) as indicated in my earlier mail, it won't throw an exception if
>you
>have a bad packet that should have a request body but doesn't.
>

Surely it will still throw later on if a dissector tries to read the
body. This will take the offset beyond the end of the buffer.
What I am proposing will make a 1.2 request packet with no body behave
exactly the same as a 1.0 request packet with no body.

>2) if you ignore that, it should be tvb_reported_length_remaining(),
>
>because tvb_length_remaining() gives the amount of *captured* data,
>not
>the amount of *actual* data, and you want to throw an exception if
>the
>capture was cut short by a snapshot length and that meant that the
>request body was present on the wire but wasn't in the capture.

OK, I'll accept it should use the reported length.

So is this likely to get accepted as an "official" patch?

Thanks for the help

Andy Ling