Wireshark-dev: Re: [Wireshark-dev] packet-rpc.c does not call an rpc sub-dissector when there a
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 12 Jan 2017 15:13:47 -0800
On Jan 12, 2017, at 3:00 PM, Richard Sharpe <realrichardsharpe@xxxxxxxxx> wrote:

> In packet-rpc.c we see this:
> 
>        /*
>         * Don't call any subdissector if we have no more date to dissect.
>         */
>        if (tvb_reported_length_remaining(tvb, offset) == 0) {
>                return TRUE;
>        }
> 
> However, this is wrong, IMO.
> 
> One of the things that our dissector functions does is insert items
> like "PROCNAME Reply" etc against the procedure etc, but I would also
> like to add text like "void" for void parameters etc.
> 
> Indeed, dissection of the NULL procedure doesn't show much useful ...
> 
> Does anyone see a problem with changing it to call the sub-dissector
> even when there is no more data to dissect?

If it reintroduces the "malformed packet" problem mentioned in bug 1392:

	https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1392

then it'd be a problem, as that check was added in

	commit 1984f23e28a19333fa4b3ae7e8e1aba7971fe2ab
	Author: Sake Blok <sake@xxxxxxxxxx>
	Date:   Tue Apr 15 22:53:34 2008 +0000

	    Fix for the "Malformed packet: RPC" that is encountered in bug 1392:

	    Don't call a RPC subdissector if there is no more data in the packet.