Are these zero length constructs actually allowed by the standard? If they are not it might be better to just abort dissection completely with a "[malformed packet]" message.
On 9/25/06, Anders Broman (AL/EAB) <[EMAIL PROTECTED]> wrote: > > Hi, > Well there is one item of Zero length :) > > Which may not be so easy to fix. > Brg > Anders > > -----Original Message----- > From: [EMAIL PROTECTED] on behalf of Oleg Kostenko > Sent: Mon 9/25/2006 11:09 AM > To: Anders Broman; wireshark-dev@wireshark.org > Subject: Re: [Wireshark-dev] Fwd: And again BER errors while > decodingH248packets > > Hello Anders, > > BER errors are gone, but now some lines tell that there is '1 item' f > something, while actually there isn't: > > ... > Item: mediaDescriptor (1) > mediaDescriptor > termStateDescr > here: propertyParms: 1 item > serviceState: inSvc (2) > streams: oneStream (0) > oneStream > localControlDescriptor > reserveValue: False > reserveGroup: False > here: propertyParms: 1 item > Item: eventsDescriptor (4) > eventsDescriptor > requestID: 0 > here: eventList: 1 item > ... > > -- > Best regards, > Oleg mailto:[EMAIL PROTECTED] > > > Monday, September 25, 2006, 1:08:29 AM, you wrote: > > AB> Hi, > AB> I have checked in a fix please verify it with your traces. > > AB> Best regards > AB> Anders > > AB> -----Ursprungligt meddelande----- > AB> Från: Oleg Kostenko [mailto:[EMAIL PROTECTED] > AB> Skickat: den 20 september 2006 10:41 > AB> Till: Anders Broman; wireshark-dev@wireshark.org > AB> Ämne: Re[2]: Fwd: And again BER errors while decoding H248packets > > AB> Hello Anders, > > AB> Here is the fragment from the ASN.1 specification for H.248. > > AB> TerminationStateDescriptor ::= SEQUENCE > AB> { > AB> propertyParms SEQUENCE OF PropertyParm, > AB> eventBufferControl EventBufferControl OPTIONAL, > AB> serviceState ServiceState OPTIONAL, > AB> ... > AB> } > > AB> As I understand, "SEQUENCE OF" means zero or more elements, so it is > AB> possible that there will be no propertyParms at all. So in terms of > AB> ASN.1 the packet is correct and no BER errors should occur. Right? > > _______________________________________________ > Wireshark-dev mailing list > Wireshark-dev@wireshark.org > http://www.wireshark.org/mailman/listinfo/wireshark-dev > > _______________________________________________ Wireshark-dev mailing list Wireshark-dev@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-dev
