diff options
authorKevin Bracey <kevin.bracey@arm.com>2016-03-30 14:10:14 +0300
committerMichael Mann <mmann78@netscape.net>2016-03-31 03:07:58 +0000
commitd81fe3907b00e00fb05a88eb0812ac874922e835 (patch)
parent3467a1f693b0d98292c341ebea8776807c195539 (diff)
Correct 6LoWPAN NHC datagram size calculations
Length calculations updating "remaining datagram size" for fragmented 6LoWPAN packets with NHC headers were incorrect if there was any elided option padding. The current header's unpadded length was subtracted from dgram_size, when it should have been the padded length - the datagram size is uncompressed IPv6. This meant the final nhdr_list entry created to represent the remaining payload would have its "reported" field too large. Most visible result of this was that the IPv6 payload length written into the packet by lowpan_reassemble_ipv6() was too large. Error probably went unnoticed because the most typical 6LoWPAN options don't need padding - the RPL option is 6 bytes, and the MPL option is 6 bytes if using 16-bit seeds, making the HbH extension header an aligned 8 bytes. Bug: 12310 Change-Id: If94e9ca57f88c4ac41f002a689ce1da7097b5bd0 Reviewed-on: https://code.wireshark.org/review/14701 Reviewed-by: Michael Mann <mmann78@netscape.net>
1 files changed, 2 insertions, 2 deletions
diff --git a/epan/dissectors/packet-6lowpan.c b/epan/dissectors/packet-6lowpan.c
index 754b61fd8b..7329119fe8 100644
--- a/epan/dissectors/packet-6lowpan.c
+++ b/epan/dissectors/packet-6lowpan.c
@@ -2005,7 +2005,7 @@ dissect_6lowpan_iphc_nhc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gi
* There are more LOWPAN_NHC structures to parse. Call ourself again
* recursively to parse them and build the linked list.
- nhdr->next = dissect_6lowpan_iphc_nhc(tvb, pinfo, tree, offset, dgram_size - ext_len - (int)sizeof(struct ip6_ext), siid, diid);
+ nhdr->next = dissect_6lowpan_iphc_nhc(tvb, pinfo, tree, offset, dgram_size - nhdr->reported, siid, diid);
else if (ipv6_ext.ip6e_nxt != IP_PROTO_NONE) {
/* Create another next header structure for the remaining payload. */
@@ -2018,7 +2018,7 @@ dissect_6lowpan_iphc_nhc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gi
nhdr->next->reported = tvb_reported_length_remaining(tvb, offset);
else {
- nhdr->next->reported = dgram_size - ext_len - ext_hlen;
+ nhdr->next->reported = dgram_size - nhdr->reported;
tvb_memcpy(tvb, LOWPAN_NHDR_DATA(nhdr->next), offset, nhdr->next->length);