ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] malformed packet for no reason

From: "Yosi Saggi" <yosis@xxxxxxxxxxxxxxxxxxxxx>
Date: Tue, 22 Mar 2011 15:56:34 +0200
Thanks. I found the problem. It was the "proto_tree_add_protocol_format"
function. I gave an incorrect starting offset


-----Original Message-----
From: wireshark-dev-bounces@xxxxxxxxxxxxx
[mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of Dirk Jagdmann
Sent: Tuesday, March 22, 2011 4:19 AM
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] malformed packet for no reason

I guess the packet you are trying to dissect is shorter than your two
loops over
i and j assume. In your inner loop you do something like:

*plen += data_size;

So plen will be greater than
bytes. Then you do a

val_ptr = tvb_get_ptr(tvb, *plen, data_size);

But tvb_get_ptr() can return NULL when out of bounds of the current
packet. I
guess this condition is reached on your 6th iteration.

---> Dirk Jagdmann
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>