[Guy Harris <gharris@xxxxxxxxxxxx>]

> #4  0x807ed2b in dissect_l2tp (pd=0x8325ce8 "", offset=70, fd=0x81c63b0, 
>     tree=0x831199c) at packet-l2tp.c:370

...which is inside a

	while (index < length) {	/* Process AVP's */

loop.

If "avp_len" happened to be zero in that loop, methinks it'd be an
infinite loop; this might happen with either

	1) a bad packet

or

	2) a packet that went past the default 68-byte default limit for
	   tcpdump - everything past that might well be zero, so if the
	   dissector wasn't checking that it hadn't gone past
	   "pi.captured_len"....