On Tue, Jun 8, 2010 at 4:20 PM, Jeff Morriss <[email protected]> wrote: > [email protected] wrote: >> Log: >> Bug 3597 - implicit octet string that is constructed causes PRES/FTAM >> dissect failure >> >> Introduced some state to remember last dissected Tag/Length so that they >> can be recalled if an IMPLICIT tag is encountered and stripped. This allows >> its to be determined if the value has a constructed value - and so can be >> reassembled. >> >> In this case, it is a IMPLICIT constructed OCTET STRING at the presentation >> layer. >> >> Many thanks to Fred Gruman for identifying - and apologies for the delay in >> commiting. > > This breaks the ANSI TCAP dissector. It now complains "BER Error: > OctetString expected but class:CONTEXT(2) primitive tag:21 was > unexpected" and then the packet is marked as unreassembled.
I'm also having problem with this patch. Have a look at this packet which is marked as "[Unreassembled Packet]", while it used to display fine with a "single-ASN1-type" in PRES. Graeme: are you able to look at this? -- Stig Bjørlykke ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
