[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7387

--- Comment #2 from Richard Sharpe <realrichardsharpe@xxxxxxxxx> 2012-06-21 11:50:15 PDT ---
This change works for tshark. I will check with wireshark later:

--- epan/dissectors/packet-windows-common.c     (revision 43430)
+++ epan/dissectors/packet-windows-common.c     (working copy)
@@ -2363,6 +2363,7 @@
        guint16 revision;
        guint32 volatile num_aces;
        gboolean missing_data = FALSE;
+       gboolean bad_ace = FALSE;

        if(parent_tree){
                item = proto_tree_add_text(parent_tree, tvb, offset, -1,
@@ -2408,7 +2409,7 @@
                              tvb, offset, 4, num_aces);
          offset += 4;

-         while(num_aces-- && !missing_data){
+         while(num_aces-- && !missing_data && !bad_ace){
                pre_ace_offset = offset;

                TRY {
@@ -2417,7 +2418,7 @@
                        /*
                         * Bogus ACE, with a length < 4.
                         */
-                       break;
+                       bad_ace = TRUE;
                  }
                }

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.