On Aug 10, 2009, at 3:41 PM, Bill Meier wrote:
guy@xxxxxxxxxxxxx wrote:
don't give up, as we'll just skip the bad item and move on to
the next item.
The dissector "skips to the next" using the bad tag length so I
thought
it better to not try to keep on dissecting.
For a fuzzed file, it'll report a bunch of bad TLVs, as it'll skip to
the wrong offset. The dissection will be ugly, but it shouldn't crash.
For a capture of traffic from a device that's putting out values that
aren't 2 bytes long for those TLVs, but where the length field is
consistent with the wrong-length value, it'll skip to the right offset.