Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 10650] New: DNS ISDN RR Sub Address field is read one byte early

[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	10650
Summary	DNS ISDN RR Sub Address field is read one byte early
Product	Wireshark
Version	1.12.1
Hardware	x86-64
OS	Windows 7
Status	UNCONFIRMED
Severity	Normal
Priority	Low
Component	Dissection engine (libwireshark)
Assignee	bugzilla-admin@wireshark.org
Reporter	boaz.brickner@gmail.com

Created attachment 13218 [details]
DNS with ISDN RR

Build Information:
Version 1.12.1 (v1.12.1-0-g01b65bf from master-1.12)

Copyright 1998-2014 Gerald Combs <gerald@wireshark.org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GTK+ 2.24.23, with Cairo 1.10.2, with Pango 1.34.0, with
GLib 2.38.0, with WinPcap (4_1_3), with libz 1.2.5, with SMI 0.4.8, with c-ares
1.9.1, with Lua 5.2, without Python, with GnuTLS 3.1.22, with Gcrypt 1.6.0,
without Kerberos, with GeoIP, with PortAudio V19-devel (built Sep 16 2014),
with
AirPcap.

Running on 64-bit Windows 7 Service Pack 1, build 7601, with WinPcap version
4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch
1_0_rel0b (20091008), GnuTLS 3.1.22, Gcrypt 1.6.0, without AirPcap.
        Intel(R) Core(TM) i5-3550 CPU @ 3.30GHz, with 16345MB of physical
memory.


Built using Microsoft Visual C++ 10.0 build 40219

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information.
--
Discovered while working on Pcap.Net (http://pcapdot.net).

In the attached pcap file, there's a single DNS packet with 3 Authoritative
RRs.
The first Authoritative RR is an ISDN RR.
The ISDN RR has Sub Address Length of 4 bytes but when reading the Sub Address
itself, Wireshark starts reading it from the length field, so the first byte
being read for the Sub Address is 0x04 which belongs to the Sub Address length
field.

---

      You are receiving this mail because:

• You are watching all bug changes.