Wireshark-bugs: [Wireshark-bugs] [Bug 11497] New: unistim dissector - message length not include
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Wed, 02 Sep 2015 19:34:29 +0000
Bug ID 11497
Summary unistim dissector - message length not included in offset for "Select Adjustable Rx Volume"
Product Wireshark
Version 1.12.7
Hardware x86
OS Windows 10
Status UNCONFIRMED
Severity Minor
Priority Low
Component Dissection engine (libwireshark)
Assignee bugzilla-admin@wireshark.org
Reporter vmisha@seznam.cz 

Created attachment 13847 [details]
The next UNISTIM command after Select Adjustable Rx Volume is selected in the
GUI showing the incorrect advancement by 3 bytes instead of 4

Build Information:
Version 1.12.7 (v1.12.7-0-g7fc8978 from master-1.12)
--
When processing the Select Adjustable Rx Volume UNISTIM message (with the size
of 4 bytes), the UNISTIM dissector advances by 3 bytes only and incorrectly
interprets all following messages in that packet. Also, it adds the suffix
"Malformed Packet".

A quick peek at the code revealed that for this specific message, the offset
variable is not incremented by the message data size (1 byte):

      case 0x20:
   /*Select Adjustable Rx Volume*/
         proto_tree_add_item(msg_tree,hf_audio_default_rx_vol_id,
                             tvb,offset,1,ENC_BIG_ENDIAN);
         break;

The correct code should be:
      case 0x20:
   /*Select Adjustable Rx Volume*/
         proto_tree_add_item(msg_tree,hf_audio_default_rx_vol_id,
                             tvb,offset,1,ENC_BIG_ENDIAN);
         offset+=msg_len;
         break;

You are receiving this mail because:
  • You are watching all bug changes.