[Guy Harris <guy@xxxxxxxxxx>]

> > The other side of the coin is that perhaps the assert shouldn't
> > blow up on FT_STRING. I'm examining that now.

Note that you also need to allow FT_BYTES items with a length of -1 as
well.

> > Regardless, the return value of tvb_length_remaining() should
> > be checked here.
> 
> Here's a proposed patch which does just that. It allows
> the TNS dissector to use -1 as the length, and the correct length
> is retrieved from the tvbuff, or,  in the case of the bad
> packet, and exception is thrown.

It looks reasonable.

> More dissectors will have to be fixed, however.

Note that those dissectors were arguably always broken, as they were
passing -1 as a length before that was a meaningful value.