Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 8221] Large SABP messages are not getting decoded

[bugzilla-daemon@xxxxxxxxxxxxx]

Comment # 2 on bug 8221 from Anders Broman

This patch "solves" part of the problem ( I tested with 0x1000 as the
multiplier valuer as the complete sequence isn't in the trace).
Index: epan/dissectors/packet-per.c
===================================================================
--- epan/dissectors/packet-per.c        (revision 47193)
+++ epan/dissectors/packet-per.c        (working copy)
@@ -389,7 +389,14 @@
                }
                return offset;
        }
-       PER_NOT_DECODED_YET("10.9.3.8.1");
+       *length = 0x4000 * tvb_get_bits8(tvb,offset-4,6);
+       if(hf_index!=-1){
+               pi = proto_tree_add_uint(tree, hf_index, tvb, (offset>>3)-1, 2,
*length);
+               if (!display_internal_per_fields) PROTO_ITEM_SET_HIDDEN(pi);
+               expert_add_info_format(actx->pinfo, pi, PI_UNDECODED, PI_ERROR,

+                       "Fragmented PER is not supported, following PER
fragment
s will not be correctly dissected.");
+       }
+       /*PER_NOT_DECODED_YET("10.9.3.8.1");*/
        return offset;
 }

I'm a bit reluctant to check it in as we do not do PER reassembly, on the other
hand this might give a better indication of the underlying problem. PER
ressembly would probably have to be done in SABP in this case.

---

      You are receiving this mail because:

• You are watching all bug changes.