["Ronnie Sahlberg" <sahlberg@xxxxxxxxxxxxxxxx>]

Hi,
forgot to attach diff.

for dcerpc dissector.

a prototype implementation of dissect_ndr_pointer()
untested, comments wanted, probably not ready for cvs yet.

first, there is a spot where i would like to rise an exception and abort
dissectong the packet marked with a comment.
how would I generate an exception here?
(the problem at this point is that an ndr pointer has been seen in a dcerpc
response packet
but the corresponding request packet has not been seen. Thus it is not
possible to dissect
it since we can not decide if this pointer is the first non-NULL occurence
or not.)

It implements pointer unmarshalling as close to DCERPC 1.1 as I could read
the spec.

Todd, you mentioned earlier that MS services uses 1.2 (or something else,
non-1.1).
Could you please try to explain the difference from 1.1 to me again. I did
not follow you
entirely in your explanation.

Attachment: dcerpc_pointer.patch
Description: Binary data