Wireshark · Wireshark-dev: Re: [Wireshark-dev] Fwd: And again BER errors whiledecodingH248packets

[LEGO <luis.ontanon@xxxxxxxxx>]

all that H.248  says about sequences is:

NOTE 2 – The ASN.1 specification below contains a clause defining
TerminationIDList as a
sequence of TerminationIDs. The length of this sequence SHALL be one,
except possibly when used in contextAuditResult.

Is that our case?

Luis.

On 9/25/06, Anders Broman (AL/EAB) <anders.broman@xxxxxxxxxxxx> wrote:
> >On 9/25/06, ronnie sahlberg <ronniesahlberg@xxxxxxxxx> wrote:
> >> Are these zero length constructs actually allowed by the standard?
> >>
> >> If they are not it might be better to just abort dissection completely
> >> with a "[malformed packet]" message.
>
> >I honestly do not know if the standard allows for that, however,
> >I do not agree with aborting dissection en tout. I believe that if we
> >can decode it we should, but an error label  (expert info) should be
> >added to the item.
> >
> >Luis
>
> If I remeber correctly the "BER" standard allows zero lengt SEQUENCE and SEQUENCE OF, I'm haven't checked if the H.248 standard
> says anything on the subject.
> It looks though like an "unusual" implementation :)
>
> Brg
> Anders
>
> _______________________________________________
> Wireshark-dev mailing list
> Wireshark-dev@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-dev


--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan