Confirmed. It was indeed a "copy-paste-did not edit correctly" bug.
While going over the code once more, I found: 1 - One bug in the heuristic. (Changed '&&' to '||') 2 - One to-do that was already done. (Removed the /* TODO */) 3 - One to-do that is now done. ;-) Patch (including the change below) attached. Taner, if it is possible, can you add a capture with the EXPEDITED* PDUs to the Wiki? (http://wiki.wireshark.org/STANAG_5066) Thanks, Menno Andriesse -----Original Message----- From: Taner KURTULUŞ [mailto:[EMAIL PROTECTED] Sent: dinsdag 12 september 2006 9:41 To: [email protected] Cc: [EMAIL PROTECTED] Subject: [patch] Stanag 5066 dissector type 25 s_prim parser's bug Hi folks, We think we've found a bug in STANAG 5066 SIS layer dissector. Problem is at S_EXPEDITED_UNIDATA_INDICATION S_Prim's parser and occurs when we receive a U_PDU via expedited unidata channel. Dissector tries to parse first 2 bytes of U_PDU as a header size of type 21 s_prim (S_UNIDATA_INDICATION). But, this is not an wanted process on that parser. Maybe, it was forgotten unchanged from S_UNIDATA_INDICATION dissector while copying it. So it shows data (U_PDU) 2 bytes short. Moreover, if data is just 1-byte, TCP datagrams receive TCP checksum error. We have corrected that bug as shown below; diff -rNu ethereal-0.99.0/epan/dissectors/packet-s5066.c ethereal-0.99.0.patched/epan/dissectors/packet-s5066.c --- ethereal-0.99.0/epan/dissectors/packet-s5066.c 2006-09-11 12:29:20.000000000 +0300 +++ ethereal-0.99.0.patched/epan/dissectors/packet-s5066.c 2006-09-11 12:31:04.000000000 +0300 @@ -1129,10 +1129,9 @@ proto_tree_add_item(tree, hf_s5066_25_tx_mode, tvb, offset, 1, FALSE); proto_tree_add_item(tree, hf_s5066_25_src_sapid, tvb, offset, 1, FALSE); offset++; offset = dissect_s5066_address(tvb, offset, tree, TRUE); - proto_tree_add_item(tree, hf_s5066_25_size, tvb, offset, 2, FALSE); offset += 2; d_pdu_size = tvb_get_ntohs(tvb, offset); - proto_tree_add_item(tree, hf_s5066_21_size, tvb, offset, 2, FALSE); offset += 2; + proto_tree_add_item(tree, hf_s5066_25_size, tvb, offset, 2, FALSE); offset += 2; /* Handle RockwellCollins (<= v2.1) 4-byte offset */ if ( (pdu_size - offset) == d_pdu_size + 4 ) { Best regards, Taner KURTULUS Voice: +903124266789 / 2085 Fax: +903124284880 Mail: [EMAIL PROTECTED] TUBITAK-UEKAE/G222 Software Development Division http://g222.uekae.tubitak.gov.tr/
packet-s5066.c.diff
Description: Binary data
_______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
