Wireshark · Ethereal-dev: [Ethereal-dev] LDAP desegmentation fix...

[Ronald Henderson <Ronald.Henderson@xxxxxxxxxxxxxxxx>]

Folks:

I have fixed a bug that occurs with the LDAP dissector when desegmentation
is enabled. If a
ASN.1 BER Universal class tag: "Sequence OF" header is encapsulated across 2
TCP segments,
and exception is thrown causing the LDAP desegmentation decode to fail. This
problem manifests
itself with LDAP request that return large search results. I have included a
diff output and a capture file
(See packet 98) that includes the LDAP TCP desegmentation I described.


Ronald W. Henderson




E:\src\ethereal\ethereal-0.9.7>diff packet-ldap.c packet-ldap.c.org
41,49d40
< /*
<  * 11/11/2002 - Fixed problem when decoding LDAP with desegmentation
enabled and the
<  *              ASN.1 BER Universal Class Tag: "Sequence Of" header is
encapsulated across 2
<  *              TCP segments.
<  *
<  * Ronald W. Henderson
<  * ronald.henderson@xxxxxxxxxxxxxxxx
<  */
<
1429,1448c1420
<
<     /*
<      * If TCP and LDAP desegmentation is enabled:
<      * Force the the TCP dissector to read into the next LDAP packet
<      * if the initial Universal Class Tag: "Sequence Of" header is not
<      * complete within this TCP packet. I required at least 6 bytes
<      * for the header which allows for a 4 byte length (ASN.1 BER)
<      */
<     if (ldap_desegment && pinfo->can_desegment) {
<       if (tvb_reported_length_remaining(tvb, a.offset) >= 6)
<         ret = read_sequence(&a, &messageLength);
<       else {
<         pinfo->desegment_offset = message_start;
<         pinfo->desegment_len = 6;
<         return;
<       }
<     } else {
<       ret = read_sequence(&a, &messageLength);
<     }
<
---
>     ret = read_sequence(&a, &messageLength);



 <<ldap-boundary-problem.pkt>>

Attachment: ldap-boundary-problem.pkt
Description: Binary data