diff options
| author | Alexis La Goutte <alexis.lagoutte@gmail.com> | 2014-10-18 16:08:58 +0200 |
|---|---|---|
| committer | Michael Mann <mmann78@netscape.net> | 2014-10-18 17:40:36 +0000 |
| commit | e7b07ae73ec1af97170a5d4dd99f71eef6b4e84f (patch) | |
| tree | 3380e35b82849fd95f8102a867efbe12ef7b04aa /epan/dissectors/packet-ipv6.c | |
| parent | 51f496220322ac518d9485afe030d0568fdae080 (diff) | |
IPv6: QuickStart option Nonce is read incorrectly
In Wireshark, the option's TTL field looks ok, but the [TTL diff] field points to the byte after the TTL field, which is part of the nonce field.
The nonce field is being read one byte after where it should be read and so the value being read is incorrect.
Moreover, the option data length says 6 but because of the extra byte being read 7 bytes are being read for this option data and the next option is read one byte later incorrectly so the options after the QuickStart option are being read incorrectly.
Found by boaz
Bug:10575
Change-Id: Icd836b2a5c2f92cef7b6fea61957a85fca5e3352
Reviewed-on: https://code.wireshark.org/review/4815
Reviewed-by: Michael Mann <mmann78@netscape.net>
Diffstat (limited to 'epan/dissectors/packet-ipv6.c')
| -rw-r--r-- | epan/dissectors/packet-ipv6.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/epan/dissectors/packet-ipv6.c b/epan/dissectors/packet-ipv6.c index d5f9a7113b..3eb4ba7c49 100644 --- a/epan/dissectors/packet-ipv6.c +++ b/epan/dissectors/packet-ipv6.c @@ -1183,10 +1183,8 @@ dissect_opts(tvbuff_t *tvb, int offset, proto_tree *tree, packet_info * pinfo, c offset += 1; proto_tree_add_item(opt_tree, hf_ipv6_opt_qs_ttl, tvb, offset, 1, ENC_NA); ttl_diff = (iph->ip_ttl - tvb_get_guint8(tvb, offset) % 256); - offset += 1; - ti = proto_tree_add_uint_format_value(opt_tree, hf_ipv6_opt_qs_ttl_diff, - tvb, offset, 1, ttl_diff, - "%u", ttl_diff); + ti = proto_tree_add_uint(opt_tree, hf_ipv6_opt_qs_ttl_diff, + tvb, offset, 1, ttl_diff); PROTO_ITEM_SET_GENERATED(ti); proto_item_append_text(ti_opt, ", %s, QS TTL %u, QS TTL diff %u", val_to_str_ext(rate, &qs_rate_vals_ext, "Unknown (%u)"), |