Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 11904] New: Follow > TCP Stream > Save As not saving correct byte values

[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	11904
Summary	Follow > TCP Stream > Save As not saving correct byte values
Product	Wireshark
Version	unspecified
Hardware	x86
OS	Windows 7
Status	UNCONFIRMED
Severity	Major
Priority	Low
Component	Common utilities (libwsutil)
Assignee	bugzilla-admin@wireshark.org
Reporter	Jim@agdatasystems.com

Created attachment 14156 [details]
Capture file of FTP upload.

Build Information:
Version 2.1.0-1095-g4bec4b0 (v2.1.0rc0-1095-g4bec4b0 from master)

Copyright 1998-2015 Gerald Combs <gerald@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with Qt 5.3.2, with WinPcap (4_1_3), with libz 1.2.8, with
GLib 2.42.0, with SMI 0.4.8, with c-ares 1.9.1, with Lua 5.2, with GnuTLS
3.2.15, with Gcrypt 1.6.2, with MIT Kerberos, with GeoIP, with QtMultimedia,
with AirPcap.

Running on 64-bit Windows 7 Service Pack 1, build 7601, with locale C, with
WinPcap version 4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version
1.0 branch 1_0_rel0b (20091008), with GnuTLS 3.2.15, with Gcrypt 1.6.2, without
AirPcap.
Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz (with SSE4.2), with 16300MB of physical
memory.

Built using Microsoft Visual C++ 12.0 build 31101
--
The attached trace file, FTP.pcapng, is a capture of an FTP upload of a small
PDF document.

Using Wireshark 2.x, select Follow > TCP Stream, then Save As. Save the file
with a name ending in .PDF and try to open it. Adobe Reader XI displays "There
was an error opening this document. The file is damaged and could not be
repaired."

If the file is extracted by following the same procedure, but with Wireshark
1.12.8 or earlier, it will open normally.

A quick look at the two files in a hex editor shows several places where the
byte values are different.

---

      You are receiving this mail because:

• You are watching all bug changes.