Wireshark-dev: [Wireshark-dev] h.261 header parsing bug
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Marat R. Gilmutdinov" <gmrt@xxxxxxx>
Date: Tue, 28 Feb 2012 16:10:56 +0400

Hello,

 

Looks like a bug in MBAP field parsing in H.261 header (packet-h261.c):

 

            /* MBAP 2nd octet, 4 bits, 3rd octet 1 bit */

            proto_tree_add_uint( h261_tree, hf_h261_mbap, tvb, offset, 1,

                ( tvb_get_guint8( tvb, offset ) & 15 )

                + ( tvb_get_guint8( tvb, offset + 1 ) >> 7 ) );

            offset++;

 

( tvb_get_guint8( tvb, offset ) & 15 ) should be multiplied by 2 (left shift by 1) before adding ( tvb_get_guint8( tvb, offset + 1 ) >> 7 ) ).

 

 

 

Marat