Wireshark · Wireshark-dev: Re: [Wireshark-dev] [Wireshark-commits] rev 33464: /trunk/epan/dissectors/ /trunk/epan/dissectors/:

[Gerald Combs <gerald@xxxxxxxxxxxxx>]

Jeff Morriss wrote:
> Gerald Combs wrote:
>> Shouldn't we remove recursion from try_get_ber_length or at least throw
>> an exception when we run into, say, 5 levels of nesting?
> 
> I don't know enough to say what's a valid depth.
> 
> In looking at the sample captures I have, I only got to a depth above 10 
> on one which is probably supposed to be valid but throws an exception in 
> the end.
> 
> But this sample capture:
> 
> http://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=c06-ldapv3-enc-r1.pcap.gz
> 
> gets depths as high as 25,604...

That was captured from the PROTOS test suite (as was the capture I
attached to bug 4951), so those depths were meant to cause problems.

A search through X.690 doesn't turn up any limits on nesting.
http://www.bgbm.org/TDWG/acc/Documents/asn1gloss.htm says "This nesting
can be as deep or as shallow as needed."