Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 9572] Tshark doesn't display the longer data fields (mbtcp)

[bugzilla-daemon@xxxxxxxxxxxxx]

Comment # 5 on bug 9572 from Roland Knall

(In reply to comment #4)
> (In reply to comment #3)
> > tightened enough. The heuristic dissection itself is exiting fast enough in
> > this case as well, as the first few checks determine, that the payload does
> > not contain a frame, and the system returns with false.
> 
> I would argue that the bug was that the system wasn't correctly returning
> false (due to a "typo" of missed brackets).  Do you agree with the fix from
> r54193 that added the brackets in the OpenSafety dissector to correctly
> return false if packet isn't handled?

Sorry, did not get it on the first reading. No, the patch does not fix the
issue. Or better framed, it fixed the issue, but leads to other side-effects.

In cases where openSAFETY is called by the "try_heuristic_dissector"
call_subdissector should be TRUE and the sub_dissector should be called. But in
cases where "try_heuristic_dissector" is not used, like MB/TCP, the
sub_dissector should not be called, but neithertheless HANDLED should be set. 

The issue here is, that HANDLED is set to true, although no dissection took
place.  This is a principal flaw in this situation and I will look into a
better fix. For now, I would prefer, that you do not back-port this, because
this will have some considerable side-effects to other openSAFETY over
implementations.

---

      You are receiving this mail because:

• You are watching all bug changes.