CFLOW: failure to decode 0 length data fields of IPFIX variable length data types.
Summary
Wireshark fails to decode IPFix (v10) variable length data types when the data element length (on the flow record) is 0. It triggers a "Malformed packet" exception, and doesn't decode the rest of the data beyond the field's offset.
Sample capture file
Attached image with the malformed packet exception. Attached capture file with two packets (template and flows). Flow nr. 2 fails to decode the 0 length field, and the rest of the flows remain un-decoded.
Steps to reproduce
Open the attached capture file. The flow were exported from Cisco ASR.
What is the current bug behavior?
Failure to decode the rest of the flows in the packet
What is the expected correct behavior?
Successfully decode data elements with 0 lengt
Build information
Version 4.2.2 (v4.2.2-0-g40459284).
Compiled (64-bit) using Microsoft Visual Studio 2022 (VC++ 14.37, build 32822), with GLib 2.78.0, with Qt 6.5.3, with libpcap, with zlib 1.3.0, with PCRE2, with Lua 5.2.4 (with UfW patches), with GnuTLS 3.8.2 and PKCS #11 (closed) support, with Gcrypt 1.10.2-unknown, with Kerberos (MIT), with MaxMind, with nghttp2 1.57.0, with nghttp3 1.0.0, with brotli, with LZ4, with Zstandard, with Snappy, with libxml2 2.11.5, with libsmi 0.5.0, with QtMultimedia, with automatic updates using WinSparkle 0.8.0, with AirPcap, with Minizip, with binary plugins.
Running on 64-bit Windows 10 (21H2), build 19044, with Intel(R) Core(TM) i7-9700 CPU @ 3.00GHz (with SSE4.2), with 16165 MB of physical memory, with GLib 2.78.0, with Qt 6.5.3, without Npcap or WinPcap, with PCRE2 10.42 2022-12-11, with c-ares 1.19.0, with GnuTLS 3.8.2, with Gcrypt 1.10.2-unknown, with nghttp2 1.57.0, with nghttp3 1.0.0, with brotli 1.0.9, with LZ4 1.9.3, with Zstandard 1.5.2, without AirPcap, with dark display mode, without HiDPI, with QPA plugin "windows", with LC_TYPE=English_Israel.utf8, binary plugins supported