From Lori Tribble:

Fix problem with the decoding of the exception schedule.  It was eating one
too many closing tags before exiting and causing the rest of the information to
fail to decode correctly.

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6178

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@38919 f5534014-38df-0310-8fa8-9805f1628bb7

1 files changed, 7 insertions, 0 deletions

diff --git a/epan/dissectors/packet-bacapp.c b/epan/dissectors/packet-bacapp.c
index 84a273de13..6bd4200c63 100644
--- a/epan/dissectors/packet-bacapp.c
+++ b/epan/dissectors/packet-bacapp.c
@@ -8396,13 +8396,19 @@ fSpecialEvent (tvbuff_t *tvb, packet_info *pinfo, proto_tree *subtree, guint off
 	guint8 tag_no, tag_info;
 	guint32 lvt;
 	guint lastoffset = 0, len;
+    gboolean closing_found = FALSE;  /* tracks when we are done decoding the fSpecialEvent entries */
 
 	while (tvb_reported_length_remaining(tvb, offset)) {  /* exit loop if nothing happens inside */
 		lastoffset = offset;
 		len = fTagHeader (tvb, offset, &tag_no, &tag_info, &lvt);
 		/* maybe a SEQUENCE of SpecialEvents if we spot a closing tag */
 		if (tag_is_closing(tag_info)) {
+			/* if we find 2 closing tags in succession we need to exit without incrementing the offset again */
+			/* This handles the special case where we have a special event entry in an RPM-ACK msg           */
+			if ( closing_found == TRUE )
+				break;
 			offset += len;
+			closing_found = TRUE;
 			continue;
 		}
 
@@ -8432,6 +8438,7 @@ fSpecialEvent (tvbuff_t *tvb, packet_info *pinfo, proto_tree *subtree, guint off
 		default:
 			return offset;
 		}
+		closing_found = FALSE; /* reset our closing tag status, we processed another open tag */
 		if (offset == lastoffset) break;     /* nothing happened, exit loop */
 	}
 	return offset;