Wireshark · Wireshark-dev: Re: [Wireshark-dev] [Wireshark-commits] rev 29373: /trunk/epan/dissectors/ /trunk/epan/dissectors/:

[Guy Harris <guy@xxxxxxxxxxxx>]

On Aug 10, 2009, at 3:41 PM, Bill Meier wrote:

> guy@xxxxxxxxxxxxx wrote:
>
> > 	don't give up, as we'll just skip the bad item and move on to
> > 	the next item.
>
> The dissector "skips to the next" using the bad tag length so I  
> thought
> it better to not try to keep on dissecting.

For a fuzzed file, it'll report a bunch of bad TLVs, as it'll skip to  
the wrong offset.  The dissection will be ugly, but it shouldn't crash.

For a capture of traffic from a device that's putting out values that  
aren't 2 bytes long for those TLVs, but where the length field is  
consistent with the wrong-length value, it'll skip to the right offset.