["Guy Harris" <gharris@xxxxxxxxx>]

Biot Olivier said:
> If I inspect the last function from the stack, the debugger points at
> basic_response_dissector() in packet-http.c at the if statement:
>
> 	if (sscanf((const gchar *)data, "%d.%d %d", &minor, &major,
> &status_code) == 3) {

Oh, *that's* not good.  As far as I know, "sscanf()" takes, as its first
argument, a C string - i.e., it has to be null-terminated, and...

> If I inspect the value returned from the statement on the line before
> the if statement:
>
> 	data = tvb_get_ptr(tvb, 5, 12);

...that's not guaranteed to be null-terminated.  (I'm not sure it's
guaranteed to have 12 characters, either....)

Perhaps it should, instead, parse the response line itself, using
"req_strlen" as an indication of the number of characters in the string
*after* the first 5 characters rather than expecting "data" to be
null-terminated.