diff options
| author | Bastien Bailly <babassbailly@free.fr> | 2015-01-22 09:50:37 +0100 |
|---|---|---|
| committer | Anders Broman <a.broman58@gmail.com> | 2015-01-22 09:56:25 +0000 |
| commit | 39a984e64915b6f34cb1fc4b42815ef08316e087 (patch) | |
| tree | 1daa7af653f77222d91fabaab26035558516c219 | |
| parent | f8fa70f4e8ceffe3603eb467ba47f19ba5abb90e (diff) | |
GTP: Bad bytes read for extended rnc id value
offset+=2; is missing and bytes used for extended rnc id value are the same that for rnc id value.
Bug:10877
Change-Id: I2830191e434812d42ab625e7a6e0478a191b7d95
Signed-off-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-on: https://code.wireshark.org/review/6738
Reviewed-by: Anders Broman <a.broman58@gmail.com>
| -rw-r--r-- | epan/dissectors/packet-gtp.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/epan/dissectors/packet-gtp.c b/epan/dissectors/packet-gtp.c index 8c56decc68..295dda65e7 100644 --- a/epan/dissectors/packet-gtp.c +++ b/epan/dissectors/packet-gtp.c @@ -5304,6 +5304,7 @@ decode_gtp_target_id(tvbuff_t * tvb, int offset, packet_info * pinfo, proto_tree offset++; /* Octet 10-11 RNC-ID*/ proto_tree_add_item(ext_tree, hf_gtp_target_rnc_id, tvb, offset, 2, ENC_BIG_ENDIAN); + offset+=2; /* If the optional Extended RNC-ID is not included, then the length variable 'n' = 8 and the overall length of the IE is 11 * octets. Otherwise, 'n' = 10 and the overall length of the IE is 13 octets */ |