In packet-ssl.c, for example, in version 14120 (see diff from previous
in
http://anonsvn.ethereal.com/viewcvs/viewcvs.py/trunk/epan/dissectors/packet-ssl.c?rev=14120&r1=13623&r2=14120
)
the line
tvb_ensure_bytes_exist(tvb, offset, 5 + record_length);
was added, to ensure only full records are dissected.
This is problematic, specific in packet-ssl.c and generally in Ethereal:
Ethereal can't be expected to always get nicely and correctly formed packets!
Specifically in packet-ssl.c, in the capture I'm working with, the
record is not complete, but the header is and so is the first message
in it.
Afterwards, the 2nd message is indeed cut (actually, it's in a previous
packet, but the reassembly code fails to find it, see a previous post
of mine about it).
So all I'm geting is 'Malformed Packet: SSL', instead of getting at least some of the data.
I agree we should ensure_bytes_exist() always, but in steps. If you can display a header, do so.
My $0.02,
Y.