Wireshark · Ethereal-dev: [Ethereal-dev] Re: [Ethereal-cvs] cvs commit: ethereal packet-dcerpc-spoolss.c

["Ronnie Sahlberg" <ronnie_sahlberg@xxxxxxxxxxxxxx>]

Hi

In your patch there are several places where you update
offset using
offset += x;

For example in dissect_DEVMODE()

This does not work if dissect_DEVMODE is called through a pointer.
You need to "protect" this by adding something like
    dcerpc_info *di = pinfo->private_data;

     if (di->conformant_run)
    		return offset;

To the beginning of the function.
(or by encapsulating the offset+=x; statement by
   if(!di->conformant_run){
        offset+=x;
    }
)


The reason for this is that in order for the dissectors in ethereal to be
able to handle
structures where a conformant array is embedded inside the structure it must
call the
structure dissector twice.
Once with conformant_run==1, where the only thing that is allowed to modify
offset are
the dissectors for conformant array headers, and one with conformant_run==0
where everything else is dissected.




----- Original Message -----
From: "Tim Potter"
Sent: Monday, November 11, 2002 4:39 PM
Subject: [Ethereal-cvs] cvs commit: ethereal packet-dcerpc-spoolss.c


> tpot        2002/11/10 23:39:52 CST
>
>   Modified files:
>     .                    packet-dcerpc-spoolss.c
>   Log:
>   Convert getprinter info 0, 1, 2, 3 to dissect_ndr routines. Hooray!
>
>   The old prs_DEVMODE function is still used by something else for the
>   moment.
>
>   Revision  Changes    Path
>   1.58      +893 -264  ethereal/packet-dcerpc-spoolss.c