Wireshark · Wireshark-dev: Re: [Wireshark-dev] [Wireshark-commits] rev 33048: /trunk/ /trunk/epan/dissectors/: packet-ber.c pac

[Stig Bjørlykke <stig@xxxxxxxxxxxxx>]

On Tue, Jun 8, 2010 at 4:20 PM, Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> wrote:
> gal@xxxxxxxxxxxxx wrote:
>> Log:
>>  Bug 3597 - implicit octet string that is constructed causes PRES/FTAM dissect failure
>>
>>  Introduced some state to remember last dissected Tag/Length so that they can be recalled if an IMPLICIT tag is encountered and stripped. This allows its to be determined if the value has a constructed value - and so can be reassembled.
>>
>>  In this case, it is a IMPLICIT constructed OCTET STRING at the presentation layer.
>>
>>  Many thanks to Fred Gruman for identifying - and apologies for the delay in commiting.
>
> This breaks the ANSI TCAP dissector.  It now complains "BER Error:
> OctetString expected but class:CONTEXT(2) primitive tag:21 was
> unexpected" and then the packet is marked as unreassembled.

I'm also having problem with this patch.  Have a look at this packet
which is marked as "[Unreassembled Packet]", while it used to display
fine with a "single-ASN1-type" in PRES.

Graeme: are you able to look at this?


-- 
Stig Bjørlykke