Wireshark-bugs: [Wireshark-bugs] [Bug 11170] New: FT_UINT64 output with tshark broken ( 32bit cl
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Sat, 02 May 2015 13:33:47 +0000
Bug ID 11170
Summary FT_UINT64 output with tshark broken ( 32bit clipping )
Product Wireshark
Version Git
Hardware All
OS All
Status UNCONFIRMED
Severity Normal
Priority Low
Component Dissection engine (libwireshark)
Assignee bugzilla-admin@wireshark.org
Reporter thies.moeller@baslerweb.com 

Created attachment 13581 [details]
gvsp packet to trigger the ft_uint64 bug

Build Information:
TShark (Wireshark) 1.99.6-400-gf744a18 (v1.99.6rc0-400-gf744a18 from master)

Copyright 1998-2015 Gerald Combs <gerald@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with WinPcap (4_1_3), with libz 1.2.8, with GLib 2.42.0, with
SMI 0.4.8, with c-ares 1.9.1, with Lua 5.2, with GnuTLS 3.2.15, with Gcrypt
1.6.2, with MIT Kerberos, with GeoIP.

Running on 64-bit Windows 7 Service Pack 1, build 7601, with locale
German_Germany.1252, with WinPcap version 4.1.3 (packet.dll version
4.1.0.2980),
based on libpcap version 1.0 branch 1_0_rel0b (20091008), with GnuTLS 3.2.15,
with Gcrypt 1.6.2.
Intel(R) Core(TM) i7-4600U CPU @ 2.10GHz (with SSE4.2), with 8097MB of physical
memory.


Built using Microsoft Visual C++ 12.0 build 31101
--
The string output using tshark -Tfields is clipping 64bit fields to 32bit.

As an example I attached a packet of the gvsp protocol using a FT_UINT64 for a
timestamp field.

1) tree output:

tshark.exe -r ft_uint64.pcapng -V -O gvsp

Frame 1: 86 bytes on wire (688 bits), 86 bytes captured (688 bits) on interface
2
Ethernet II, Src: Basler_5f:01:f6 (00:30:53:5f:01:f6), Dst: Dell_29:7d:de
(ec:f4:bb:29:7d:de)
Internet Protocol Version 4, Src: 169.254.44.102 (169.254.44.102), Dst:
169.254.200.30 (169.254.200.30)
User Datagram Protocol, Src Port: 56725 (56725), Dst Port: 56725 (56725)
GigE Vision Streaming Protocol
...
    Timestamp: 0xffffffffffffffff
...


2) Fields output
tshark.exe -Tfields -e gvsp.timestamp -r ft_uint64.pcapng

4294967295

----

-- only the lower 32bit are available.

I will provide a patch. ft-integer and to_str are involved

You are receiving this mail because:
  • You are watching all bug changes.