Wireshark-dev: Re: [Wireshark-dev] malformed packet
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Mon, 07 Jul 2008 11:26:22 -0400


Martin Corraine (mcorrain) wrote:

Hello,
If I check a packet's header and size and return 0 because it wasn't my protocol (GED125), should I get the following message: "Malformed Packet: GED125"? 

Probably not.
Are you sure it's actually returning 0 for that packet? It sounds like your dissector generated an exception (normally because it read beyond the end of a TVB). Maybe you need to check tvb_length() before the rest of your heuristic checks?