Wireshark · Ethereal-dev: Re: [Ethereal-dev] Patch for UDP header length

[Graeme Hewson <ghewson@xxxxxxxxxxxxxxxxxxx>]

Graeme Hewson wrote:
> The attached patch puts out a warning if the UDP header Length field is 
> longer than it ought to be.
>
> Ethereal should also take account of UDP Jumbograms, as described in RFC 
> 2675, where the Length field is zero, but I haven't included support for 
> this in my patch since I don't have a sample packet.

So while hidden fields get discussed, please could someone check in my 
change (which doesn't have any new code using hidden fields).  I attach 
an updated version of the patch which adds a comment about jumbograms.


Graeme Hewson

--- packet-udp.c.orig	2006-01-02 11:50:50.000000000 +0000
+++ packet-udp.c	2006-01-12 19:16:29.000000000 +0000
@@ -217,6 +217,7 @@
     udph->uh_ulen = udph->uh_sum_cov = tvb_get_ntohs(tvb, offset+4);
     if (udph->uh_ulen < 8) {
       /* Bogus length - it includes the header, so it must be >= 8. */
+      /* XXX - should handle IPv6 UDP jumbograms (RFC 2675), where the length is zero */
       if (tree) {
         proto_tree_add_uint_format(udp_tree, hf_udp_length, tvb, offset + 4, 2,
           udph->uh_ulen, "Length: %u (bogus, must be >= 8)", udph->uh_ulen);
@@ -224,8 +225,15 @@
       return;
     }
     if (tree) {
-      proto_tree_add_uint(udp_tree, hf_udp_length, tvb, offset + 4, 2, udph->uh_ulen);
-      proto_tree_add_uint_hidden(udp_tree, hf_udplite_checksum_coverage, tvb, offset + 4, 0, udph->uh_sum_cov);
+      if ((udph->uh_ulen > pinfo->iplen - pinfo->iphdrlen) && ! pinfo->fragmented) {
+        proto_tree_add_uint_format(udp_tree, hf_udp_length, tvb, offset + 4, 2,
+          udph->uh_ulen, "Length: %u (bogus, should be %u)", udph->uh_ulen,
+          pinfo->iplen - pinfo->iphdrlen);
+      } else {
+        proto_tree_add_uint(udp_tree, hf_udp_length, tvb, offset + 4, 2, udph->uh_ulen);
+        proto_tree_add_uint_hidden(udp_tree, hf_udplite_checksum_coverage, tvb, offset + 4,
+          0, udph->uh_sum_cov);
+      }
     }
   } else {
     udph->uh_ulen = pinfo->iplen - pinfo->iphdrlen;