On Jan 12, 2017, at 3:00 PM, Richard Sharpe <[email protected]> wrote:
> In packet-rpc.c we see this:
>
> /*
> * Don't call any subdissector if we have no more date to dissect.
> */
> if (tvb_reported_length_remaining(tvb, offset) == 0) {
> return TRUE;
> }
>
> However, this is wrong, IMO.
>
> One of the things that our dissector functions does is insert items
> like "PROCNAME Reply" etc against the procedure etc, but I would also
> like to add text like "void" for void parameters etc.
>
> Indeed, dissection of the NULL procedure doesn't show much useful ...
>
> Does anyone see a problem with changing it to call the sub-dissector
> even when there is no more data to dissect?
If it reintroduces the "malformed packet" problem mentioned in bug 1392:
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1392
then it'd be a problem, as that check was added in
commit 1984f23e28a19333fa4b3ae7e8e1aba7971fe2ab
Author: Sake Blok <[email protected]>
Date: Tue Apr 15 22:53:34 2008 +0000
Fix for the "Malformed packet: RPC" that is encountered in bug 1392:
Don't call a RPC subdissector if there is no more data in the
packet.
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <[email protected]>
Archives: https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
mailto:[email protected]?subject=unsubscribe
