Re: [Wireshark-commits] rev 37826: /trunk/epan/dissectors/ /trunk/epan/dissectors/: packet-rpcap.c

[Stig Bjørlykke <stig () bjorlykke org>]

On Wed, Jun 29, 2011 at 7:21 AM,  <guy () wireshark org> wrote:
>  Don't return an offset that you won't later use.
>
>  The length fields in a pcap_pkthdr are unsigned, so presumably the
>  equivalent fields in the rpcap protocol are also unsigned.
>
>  Make sure the captured data length isn't bigger than the remaining data
>  in the packet before attempting to construct a tvbuff for the packet
>  data.  If it is, report that as an error, and don't even try to
>  construct the tvbuff; that'll fail.  This fixes bug 6073.

I did not find that this fixed bug 6073, I still get long load time.

I have strengthened the heuristics in revision 37828, which seems to
really fix the problem.

The offset calculations was left on purpose, to easy extend the dissector later.


-- 
Stig Bjørlykke
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe