[Yaniv Kaul <ykaul@xxxxxxxxxxxx>]

1. in packet-ldap.c, it is written:
       /*
        * XXX - this assumes that the LDAP_RES_SEARCH_ENTRY and
        * LDAP_RES_SEARCH_RESULT appear in the same frame.
        */


I don't see it happening. There's dissection for LDAP_RES_SEARCH_ENTRY 
and that's about it - although LDAP_RES_SEARCH_RESULT *does* appear in 
the same frame.
Could it be because it's inside SASL? I've seen these kind of packets in 
a normal W2K login to domain controller.

2. Besides using the 'old' ASN1 decoding stuff, there's the horrible 
habbit of using loop internal variables all over. For example, in 
dissect_ldap_response_search_entry():
...
 while (a->offset < end_of_sequence)
 {
   proto_item *ti;
   proto_tree *attr_tree;
   guint set_length;
   int end_of_set;

...

and
...
     } else {
       guint cls, con, tag;
       gboolean def;
       guint len;
       int start = a->offset;
       int ret;
       tvbuff_t *mscldap_tvb=NULL;

       ret = asn1_header_decode(a, &cls, &con, &tag, &def, &len);

...