diff options
| author | Guy Harris <guy@alum.mit.edu> | 2018-02-22 21:21:19 -0800 |
|---|---|---|
| committer | Guy Harris <guy@alum.mit.edu> | 2018-02-23 05:21:55 +0000 |
| commit | 017167fb34220a17af361d50b2d239927acac7c1 (patch) | |
| tree | 521e649e55a30fe3bc9f55d698f11617d4b53d3d /epan/dissectors/packet-ns-rpc.c | |
| parent | 86f329aa940388d981b25c2b3c966313335c2ed9 (diff) | |
Just use tvb_memeql() to check the signature.
That's one of the things it's intended to do - check the values of parts
of the packet that might not actually be there. The comparison fails if
either 1) it's all there and doesn't match or 2) it's not all there.
Change-Id: I0f97ea5f75c2cada511e254ec096d294ea710f45
Reviewed-on: https://code.wireshark.org/review/26040
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Diffstat (limited to 'epan/dissectors/packet-ns-rpc.c')
| -rw-r--r-- | epan/dissectors/packet-ns-rpc.c | 12 |
1 files changed, 4 insertions, 8 deletions
diff --git a/epan/dissectors/packet-ns-rpc.c b/epan/dissectors/packet-ns-rpc.c index 031ad8986a..85ddb9ee16 100644 --- a/epan/dissectors/packet-ns-rpc.c +++ b/epan/dissectors/packet-ns-rpc.c @@ -1128,7 +1128,7 @@ dissect_ns_rpc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _ ns_rpc_tree = proto_item_add_subtree(ti, ett_nsrpc); proto_tree_add_item_ret_uint(ns_rpc_tree, hf_nsrpc_dlen, tvb, offset, 4, ENC_LITTLE_ENDIAN, &datalen); - offset += 8; + offset += 8; /* skip length, signature, and 2 more bytes */ proto_tree_add_item_ret_uint(ns_rpc_tree, hf_nsrpc_cmd, tvb, offset, 1, ENC_LITTLE_ENDIAN, &rpc_cmd); offset += 2; if (rpc_cmd & 0x80) @@ -1164,14 +1164,10 @@ dissect_ns_rpc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _ static gboolean dissect_ns_rpc_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data) { - guint16 ns_rpc_sig; + static const guint8 ns_rpc_sig[2] = { 0xA5, 0xA5 }; - if (tvb_captured_length(tvb) < 6) - return FALSE; - - /* Get the signature */ - ns_rpc_sig = tvb_get_letohs(tvb, 4); - if (ns_rpc_sig != 0xA5A5) + /* Check the signature */ + if (tvb_memeql(tvb, 4, ns_rpc_sig, sizeof ns_rpc_sig) != 0) return FALSE; dissect_ns_rpc(tvb, pinfo, tree, data); |