Wireshark-bugs: [Wireshark-bugs] [Bug 9381] Wireshark tvb_reported_length_remaining() does not r
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Mon, 04 Nov 2013 20:44:12 +0000

Comment # 1 on bug 9381 from 
To back up a little bit, I was originally trying to add an "Expert-Info" for
such malformed packets.  I've already submitted a patch to Wireshark (see
BUG9364 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9364).

I'd tested that patch on 1.8.2 and it works if the whole response comes in the
same packet.  I ported it to SVN and I was just testing with a hand-crafted
response using netcat, and I see that the patch doesn't really work for the
attached case!  :-)

The patch basically adds this einfo:

1167            if (reported_datalen > headers.content_length) {
1168                    expert_add_info_format(pinfo, http_tree,
&ei_http_contentlength_mismatch,
1169                                    "Actual length %d greater than
Content-Length header value %"
1170                                    G_GINT64_FORMAT
1171                                    ", using header value",
1172                                    reported_datalen,
headers.content_length);
1173                    reported_datalen = (int)headers.content_length;
1174            }

You are receiving this mail because:
  • You are watching all bug changes.