From Iain Arnell:

AJP13 uses a string size of 0xFFFF to indicate a null string;
ajp13_get_nstring function would incorrectly return invalid data.

In disaply_req_body function, the content_length really is the length of
the data; there is no trailing null.

svn path=/trunk/; revision=39416

1 files changed, 5 insertions, 1 deletions

diff --git a/epan/dissectors/packet-ajp13.c b/epan/dissectors/packet-ajp13.c
index 2174cff4d1..9788c7a916 100644
--- a/epan/dissectors/packet-ajp13.c
+++ b/epan/dissectors/packet-ajp13.c
@@ -255,6 +255,10 @@ ajp13_get_nstring(tvbuff_t *tvb, gint offset, guint16* ret_len)
   if (ret_len)
     *ret_len = len+1;
 
+  /* a size of 0xFFFF indicates a null string - no data follows */
+  if (len == 0xFFFF)
+    len = 0;
+
   return tvb_format_text(tvb, offset+2, MIN(len, ITEM_LABEL_LENGTH));
 }
 
@@ -443,7 +447,7 @@ display_req_body(tvbuff_t *tvb, proto_tree *ajp13_tree, ajp13_conv_data* cd)
    */
   content_length = tvb_get_ntohs( tvb, pos);
   cd->content_length -= content_length;
-  proto_tree_add_item(ajp13_tree, hf_ajp13_data, tvb, pos+2, content_length-1, ENC_UTF_8|ENC_BIG_ENDIAN);
+  proto_tree_add_item(ajp13_tree, hf_ajp13_data, tvb, pos+2, content_length, ENC_UTF_8|ENC_BIG_ENDIAN);
 }