https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13651
Bug ID: 13651
Summary: Regression in sccp fragments handling
Product: Wireshark
Version: 2.2.6
Hardware: x86-64
OS: Ubuntu
Status: UNCONFIRMED
Severity: Major
Priority: Low
Component: Dissection engine (libwireshark)
Assignee: bugzilla-ad...@wireshark.org
Reporter: nardi.i...@gmail.com
Target Milestone: ---
Created attachment 15498
--> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=15498&action=edit
Pcap to reproduce the issue
Build Information:
Version 2.2.6 (Git Rev Unknown from unknown)
Copyright 1998-2017 Gerald Combs <ger...@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is
NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR
PURPOSE.
Compiled (64-bit) with Qt 5.5.1, with libpcap, with POSIX capabilities
(Linux), with libnl 3, with GLib 2.48.2, with zlib 1.2.8, with SMI
0.4.8, with c-ares 1.10.0, with Lua 5.2.4, with GnuTLS 3.4.10, with
Gcrypt 1.6.5, with MIT Kerberos, with GeoIP, with nghttp2 1.7.1, with
QtMultimedia, without AirPcap.
Running on Linux 4.4.0-72-generic, with locale LC_CTYPE=en_US.UTF-8,
LC_NUMERIC=it_IT.UTF-8, LC_TIME=it_IT.UTF-8, LC_COLLATE=en_US.UTF-8,
LC_MONETARY=it_IT.UTF-8, LC_MESSAGES=en_US.UTF-8,
LC_PAPER=it_IT.UTF-8, LC_NAME=it_IT.UTF-8, LC_ADDRESS=it_IT.UTF-8,
LC_TELEPHONE=it_IT.UTF-8, LC_MEASUREMENT=it_IT.UTF-8,
LC_IDENTIFICATION=it_IT.UTF-8, with libpcap version 1.7.4, with GnuTLS
3.4.10, with Gcrypt 1.6.5, with zlib 1.2.8.
Intel(R) Core(TM) i7-4810MQ CPU @ 2.80GHz (with SSE4.2)
Built using gcc 5.4.0 20160609.
--
Hi
I may have found a regression in sccp DT1 fragments handling in the
latest 2.2.6 version; everything is fine on 2.2.5
Using the attached pcap, fragments in pkts 3 and 4 are not correctly
reassembled as a ranap id-RelocationResourceAllocation message anymore but as a
malformed id-RAB-Assignment message
Am I doing something wrong?
Thanks
Ivan
PS: checksums in the pcap may be wrong because of a hand-made effort
to anonymize some information
--
You are receiving this mail because:
You are watching all bug changes.___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <wireshark-bugs@wireshark.org>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
