Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 6950] Detecting malformed package dissection disables dissector for WS session

[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6950

--- Comment #3 from Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> 2012-03-14 18:37:24 PDT ---
OK, looks like my suspicion was right: the problem is in the OpenSafety
dissector itself.  The problem is here:

~~~
   1412     /* We will call the epl dissector by using call_dissector(). The
epl dissector will then call
   1413      * the heuristic openSAFETY dissector again. By setting this
information, we prevent a dissector
   1414      * loop */
   1415     if ( calledOnce == FALSE )
   1416     {
   1417         calledOnce = TRUE;
   1418         
   1419         firstByte = ( tvb_get_guint8(message_tvb, 0) << 1 );
   1420         
   1421         /* No frames can be sent in SoA and SoC messages, therefore
those get filtered right away */
   1422         if ( ( firstByte != 0x02 ) && ( firstByte != 0x0A ) )
   1423         {
   1424             result =
opensafety_package_dissector("openSAFETY/Powerlink", "epl",
   1425                                                   FALSE, FALSE, 0,
message_tvb, pinfo, tree);
   1426         }
   1427          
   1428         calledOnce = FALSE;
   1429     }
~~~

When an exception is thrown the code to reset calledOnce to FALSE (line 1428)
is never run (because the exception longjmp()'d out of the dissector).  The
result is calledOnce is set to TRUE until you restart Wireshark.

Another (exception-friendly) way to avoid the loop mentioned in the comment
needs to be found.

Since you're the author of the dissector, would you like to do that, or do you
want me to?

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.