diff options
| author | Stefan Metzmacher <metze@samba.org> | 2022-02-23 20:45:12 +0100 |
|---|---|---|
| committer | A Wireshark GitLab Utility <gerald+gitlab-utility@wireshark.org> | 2022-02-24 08:53:17 +0000 |
| commit | b9fcfd4f10727d780635d3f6092b1d06a1a2e2a5 (patch) | |
| tree | ef63e574659bba88c640322dfeb77434eeb9c554 /epan/dissectors/packet-ntlmssp.c | |
| parent | ef31431aebf8a22a44bf5a97b576d108741c3e75 (diff) | |
NTLMSSP: fix AUTHENTICATE_MESSAGE without NTLMSSP_NEGOTIATE_VERSION
If we have data remaining before the start of the variable data,
we should assume the space for the version field even without
the NTLMSSP_NEGOTIATE_VERSION flag. In that case we should
mark the 8 bytes as zero bytes.
This fixes https://gitlab.com/wireshark/wireshark/-/issues/17958
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Diffstat (limited to 'epan/dissectors/packet-ntlmssp.c')
| -rw-r--r-- | epan/dissectors/packet-ntlmssp.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/epan/dissectors/packet-ntlmssp.c b/epan/dissectors/packet-ntlmssp.c index 3f097ad60b..bd4218748e 100644 --- a/epan/dissectors/packet-ntlmssp.c +++ b/epan/dissectors/packet-ntlmssp.c @@ -2048,8 +2048,12 @@ dissect_ntlmssp_auth (tvbuff_t *tvb, packet_info *pinfo, int offset, /* If there are more bytes before the data block dissect a version field if NTLMSSP_NEGOTIATE_VERSION is set in the flags (see MS-NLMP) */ if (offset < data_start) { - if (negotiate_flags & NTLMSSP_NEGOTIATE_VERSION) + if (negotiate_flags & NTLMSSP_NEGOTIATE_VERSION) { offset = dissect_ntlmssp_version(tvb, offset, ntlmssp_tree); + } else { + proto_tree_add_item(ntlmssp_tree, hf_ntlmssp_ntlmv2_response_z, tvb, offset, 8, ENC_NA); + offset += 8; + } } /* If there are still more bytes before the data block dissect an MIC (message integrity_code) field */ |