Wireshark-dev: Re: [Wireshark-dev] [Wireshark-commits] rev 29373: /trunk/epan/dissectors/ /trun
From: Guy Harris <[email protected]>
Date: Mon, 10 Aug 2009 15:49:18 -0700
On Aug 10, 2009, at 3:41 PM, Bill Meier wrote:

[email protected] wrote:

	don't give up, as we'll just skip the bad item and move on to
	the next item.

The dissector "skips to the next" using the bad tag length so I  
it better to not try to keep on dissecting.
For a fuzzed file, it'll report a bunch of bad TLVs, as it'll skip to  
the wrong offset.  The dissection will be ugly, but it shouldn't crash.
For a capture of traffic from a device that's putting out values that  
aren't 2 bytes long for those TLVs, but where the length field is  
consistent with the wrong-length value, it'll skip to the right offset.