[Wireshark code review <code-review-do-not-reply@xxxxxxxxxxxxx>]

URL: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=5ade437ffe07627a380bcd4dfb3d35ad57d252d7
Submitter: Guy Harris (guy@xxxxxxxxxxxx)
Changed: branch: master
Repository: wireshark

Commits:

5ade437 by Guy Harris (guy@xxxxxxxxxxxx):

    Treat a length of -1 as a Very Large Length in most cases.
    
    For field types where it doesn't mean "to the end of the tvbuff", treat
    it like other negative length values - as if it were unsigned and thus
    Very Large and thus likely to be past the end of the tvbuff.  That way,
    some of the "we hax0red your SNMP packets" captures, with length fields
    of 0xffffffff, report malformed packets rather than dissector bugs.
    
    Change-Id: Id53f828b06b6febe7d79f8539e54523e0b43e5c2
    Reviewed-on: https://code.wireshark.org/review/4091
    Reviewed-by: Guy Harris <guy@xxxxxxxxxxxx>
    

Actions performed:

    from  887f7f1   Register hfi_rip_zero_padding.
    adds  5ade437   Treat a length of -1 as a Very Large Length in most cases.


Summary of changes:
 epan/proto.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)