Wireshark-dev: Re: [Wireshark-dev] Bug? TPKT length invalid? DIFF
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Charles Lepple" <clepple@xxxxxxxxx>
Date: Thu, 25 Jan 2007 11:27:31 -0500
On 1/25/07, Wiese, Hendrik <hendrik.wiese@xxxxxxxxxxx> wrote:

Hi there,

I think, I've found a bug: the length of a TPKT header evaluated later
is swapped by tvb_get_ntohs() (Wireshark 0.99.6
/epan/dissectors/packet-tpkt.c:193). It only works for us if we re-swap
it with g_htons() just after fetching it from the tvb:


Are you sure your TPKT has the proper endian-ness?

Is wireshark detecting the proper endianness for your platform?


packet-tpkt.c:193: data_len = g_htons(tvb_get_ntohs(tvb, offset + 2));



From a code readability standpoint, this is not good.


The way I read this, you are getting a short from a TVB, and
converting it from network byte order to host byte order. Then,
g_htons() converts from host to network byte order. Strictly speaking,
you shouldn't assign something in network byte order to a host
variable, and then perform arithmetic on the variable in "network byte
order" (even if it is correctly swapped).

This can cause problems later on if someone tries to debug this
problem on a big-endian platform.

--
- Charles Lepple