diff options
| author | sahlberg <sahlberg@f5534014-38df-0310-8fa8-9805f1628bb7> | 2006-11-21 21:11:18 +0000 |
|---|---|---|
| committer | sahlberg <sahlberg@f5534014-38df-0310-8fa8-9805f1628bb7> | 2006-11-21 21:11:18 +0000 |
| commit | 5521b3001b52e03db0d484fd9a9e792c1ea99a06 (patch) | |
| tree | 7af886ec6ccd2b5e100dd15d68ea4d5397cd8adc /epan/dissectors/packet-dcerpc.c | |
| parent | 7fed36982c63ae4db577826aecefddb73817760f (diff) | |
fix for bug 1226:
reported by Benjamin Meyer
WireShark marks DCE RPC FACKs as "malformed" if they do not have a body.
According to DCE RPC Spec. 1.1 FACKs "may contain" a body PTU.
I am unable to build WireShark (lack of time to install all neccessary stuff)
but I looked at the SourceCode. I think, at least this has to be fixed:
file: epan/dissectors/packet-dcerpc.c
function: static gboolean dissect_dcerpc_dg (tvbuff_t *tvb, packet_info *pinfo,
proto_tree *tree)
*snip*
case PDU_FACK
dissect_dcerpc_dg_fack (tvb, offset, pinfo, dcerpc_tree, &hdr);
break;
*snap*
I guess, it should look like "case PDU_NOCALL:" directly above.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@19952 f5534014-38df-0310-8fa8-9805f1628bb7
Diffstat (limited to 'epan/dissectors/packet-dcerpc.c')
| -rw-r--r-- | epan/dissectors/packet-dcerpc.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/epan/dissectors/packet-dcerpc.c b/epan/dissectors/packet-dcerpc.c index 86b5e8aa0c..e50d82f605 100644 --- a/epan/dissectors/packet-dcerpc.c +++ b/epan/dissectors/packet-dcerpc.c @@ -4981,7 +4981,10 @@ dissect_dcerpc_dg (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) break; case PDU_FACK: - dissect_dcerpc_dg_fack (tvb, offset, pinfo, dcerpc_tree, &hdr); + /* Body is optional */ + /* XXX - we assume "frag_len" is the length of the body */ + if (hdr.frag_len != 0) + dissect_dcerpc_dg_fack (tvb, offset, pinfo, dcerpc_tree, &hdr); break; case PDU_REJECT: |