Wireshark · Wireshark-dev: Re: [Wireshark-dev] [Wireshark-commits] rev 37826: /trunk/epan/dissectors/ /trunk/epan/dissectors/:

[Stig Bjørlykke <stig@xxxxxxxxxxxxx>]

On Wed, Jun 29, 2011 at 7:21 AM,  <guy@xxxxxxxxxxxxx> wrote:
>  Don't return an offset that you won't later use.
>
>  The length fields in a pcap_pkthdr are unsigned, so presumably the
>  equivalent fields in the rpcap protocol are also unsigned.
>
>  Make sure the captured data length isn't bigger than the remaining data
>  in the packet before attempting to construct a tvbuff for the packet
>  data.  If it is, report that as an error, and don't even try to
>  construct the tvbuff; that'll fail.  This fixes bug 6073.

I did not find that this fixed bug 6073, I still get long load time.

I have strengthened the heuristics in revision 37828, which seems to
really fix the problem.

The offset calculations was left on purpose, to easy extend the dissector later.


-- 
Stig Bjørlykke