Wireshark-dev: Re: [Wireshark-dev] Better dissection in the SMB dissector when captures contain
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Richard Sharpe <realrichardsharpe@xxxxxxxxx>
Date: Wed, 3 Oct 2012 13:22:53 -0700
On Wed, Oct 3, 2012 at 7:25 AM, Richard Sharpe
<realrichardsharpe@xxxxxxxxx> wrote:
> On Tue, Oct 2, 2012 at 10:43 PM, Jaap Keuter <jaap.keuter@xxxxxxxxx> wrote:
>> Hi,
>>
>> I think this is correct, checking for the availability of data in the TVB is
>> independent of the question if the tree is available or not. That fact should
>> not have influence on the interpretation of the data.

Attached is a first patch that cleans up all the entries that have a
Next Entry Offset and correctly checks that the required number of
bytes is available (checked both with a capture that contained
truncated frames and one that did not.)

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)

Attachment: packet-smb-ff2-fixups.patch
Description: Binary data