[Wireshark-dev] Wireshark 4.4.0 - NAS 5GS - issue with NAS message container if EPS NAS message container is present

[Dragos Minuta]

Hi,

There is decoding NAS 5GS - NAS message container, if EPS NAS message container 
is also present inside NAS 5GS  PDU.
Attached pcap.
>From my analysis it looks that NAS message container is taking Security Header 
>type field from previously decoded EPS NAS message instead of taking it from 
>NAS 5GS PDU.

This change fixed the issue:

diff --git a/epan/dissectors/packet-nas_5gs.c b/epan/dissectors/packet-nas_5gs.c
index 2e2a61ae94..7af040b4a0 100644
--- a/epan/dissectors/packet-nas_5gs.c
+++ b/epan/dissectors/packet-nas_5gs.c
@@ -2574,6 +2574,7 @@ de_nas_5gs_mm_eps_nas_msg_cont(tvbuff_t *tvb, proto_tree 
*tree, packet_info *pin
         col_set_fence(pinfo->cinfo, COL_PROTOCOL);
         call_dissector(nas_eps_handle, tvb_new_subset_length(tvb, offset, 
len), pinfo, tree);
     }
+    (pinfo->curr_layer_num)--;

     return len;
 }

Can you please let me know if indeed this is a bug and if my change is a valid 
fix?

Thanks,
Dragos

nas-2.pcapng
Description: nas-2.pcapng

_______________________________________________
Wireshark-dev mailing list -- wireshark-dev@wireshark.org
To unsubscribe send an email to wireshark-dev-le...@wireshark.org