[Andy.Ling@xxxxxxxxxxx]

First a bit of history for those not keeping up.

I have found that any CORBA dissector built using the
omniidl / python stuff marks a packet as Malformed
for CORBA 1.2 requests that don't have any arguments.

I have tracked the problem down to a ReportedBoundsError
exception being thrown by start_dissecting calling
proto_tree_add_item when there are no arguments to
be added.

It looks like this is a CORBA 1.2 problem and is being
caused by packet-giop.c

In dissect_giop_request_1_2 there is some code that looks like :-

  decode_ServiceContextList(tvb, request_tree, &offset,
                  stream_is_big_endian, GIOP_HEADER_SIZE);

  /*
   * GIOP 1.2 Request body must fall on an 8 octet alignment, taking into
   * account we are in a new tvbuff, GIOP_HEADER_SIZE octets from the
   * GIOP octet stream start.
   */

  set_new_alignment(&offset, GIOP_HEADER_SIZE, 8);

When there are no arguments the service context list is empty
so the call to set_new_alignment may and usually does, set
the offset beyond the length of the buffer.

proto_tree_add_item is designed to cope with offset equal to
the buffer length, but not beyond it. So it throws.

There are several ways to fix this and I don't know enough about
the code to know which is the best.

A fairly "safe" fix is to change start_dissecting in wireshark_gen.py
to look like :-

static proto_tree *start_dissecting(tvbuff_t *tvb, packet_info *pinfo, 
proto_tree *ptree, int *offset) {

    proto_item *ti = NULL;
    proto_tree *tree = NULL;            /* init later, inside if(tree) */

    if (check_col(pinfo->cinfo, COL_PROTOCOL))
        col_set_str(pinfo->cinfo, COL_PROTOCOL, "Q_QUENTINV3");

    /*
     * Do not clear COL_INFO, as nothing is being written there by
     * this dissector yet. So leave it as is from the GIOP dissector.
     * TODO: add something useful to COL_INFO
     *  if (check_col(pinfo->cinfo, COL_INFO))
     *     col_clear(pinfo->cinfo, COL_INFO);
     */

+    if (tvb_length_remaining(tvb, *offset) < 0)
+      return NULL ;

    if (ptree) {
          ......


Regards

Andy Ling