Wireshark-dev: Re: [Wireshark-dev] ENC: Wireshark-dev: Re: RTCP frame length error indication i
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Wed, 09 Jan 2008 08:24:42 +0100
Hi,

That string isn't NULL terminated, but the code expects it to be.
See packet-rtcp.c:dissect_rtcp_bye(). It even counts that NULL byte, which doesn't exist. Then the BYE message is expected to be padded out to fit word size. Counting the non existing NULL byte makes it pad 3 more bytes to it, making it invent the 4 bytes it misses from the expected length.
You should file a bug report on it with this description and your capture file, so that dissect_rtcp_bye() can be made more robust and create the proper expert info (string not NULL terminated). 

Thanx,
Jaap

Herculano Antonio Lambert Duarte wrote:

Hi!

	Sorry for the delay.
Attached is a packet with a RTCP Bye, and the error indication. Thank you for your attention. Best regards, Herculano ===================================================== 
	From: "Martin Mathieson" <martin.r.mathieson@xxxxxxxxxxxxxx <mailto:martin.r.mathieson@DOMAIN.HIDDEN> >
	Date: Thu, 20 Dec 2007 16:52:01 +0000
	
	Could you please post this as a capture? Remember that the string is NULL terminated, and that this is part of the length....
===================================================== 
	On Dec 20, 2007 2:34 PM, Herculano Antonio Lambert Duarte < hduarte@xxxxxxxxxxx <mailto:hduarte@xxxxxxxxxxx> > wrote:
	

		Hi!
When the RTCP packet has a BYE chunk included, there is an expert message "RTCP frame length check: wrong (expected 104 bytes, found 108)" (the numbers belong to an example captured in field test), but the number of octets is correct (see the example below). 
		===
		Frame 1457 (146 bytes on wire, 146 bytes captured)
		Ethernet II, Src: TróPicoS_00:00:99 (00:1a:90:00:00:99), Dst: Unispher_40:68:71 (00:90:1a:40:68:71)
		Internet Protocol, Src: 200.168.14.107 (200.168.14.107), Dst: 200.168.13.203 (200.168.13.203 )
		User Datagram Protocol, Src Port: 32061 (32061), Dst Port: 5273 (5273)
		Real-time Transport Control Protocol (Sender Report)
		   [Stream setup by SDP (frame 260)]
10.. .... = Version: RFC 1889 Version (2) ..0. .... = Padding: False 
		   ...0 0001 = Reception report count: 1
		   Packet type: Sender Report (200)
		   Length: 12 (52 bytes)
		   Sender SSRC: 0x12345678 (305419896)
Timestamp, MSW: 29 (0x0000001d) Timestamp, LSW: 3444563771 (0xcd4fdf3b) 
		   [MSW and LSW as NTP timestamp: Feb  7, 2036 06:28:45,8020 UTC]
		   RTP timestamp: 1476661580
		   Sender's packet count: 300
Sender's octet count: 4236 Source 1 
		Real-time Transport Control Protocol (Source description)
		   [Stream setup by SDP (frame 260)]
		   10.. .... = Version: RFC 1889 Version (2)
		   ..0. .... = Padding: False
...0 0001 = Source count: 1 Packet type: Source description (202) 
		   Length: 6 (28 bytes)
		   Chunk 1, SSRC/CSRC 0x12345678
		Real-time Transport Control Protocol (Goodbye)
		   [Stream setup by SDP (frame 260)]
10.. .... = Version: RFC 1889 Version (2) ..0. .... = Padding: False 
		   ...0 0001 = Source count: 1
		   Packet type: Goodbye (203)
		   Length: 5 (24 bytes)
		   Identifier: 0x12345678 (305419896)
		   Length: 15
		   Text: session stopped
		[RTCP frame length check: Wrong (expected 104 bytes, found 108)]
		===
		
		Herculano A. L. Duarte