Ethereal-dev: [Ethereal-dev] Patch for Bug in RTCP "BYE" packet parsing

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Venna, Nagarjuna" <nvenna@xxxxxxxxxxx>
Date: Thu, 10 Jan 2002 16:09:26 -0500
Ethereal displays "BYE" packets as "Malformed Frame" if the optional
"Reason" parameter is missing. I've a patch that claims to fix the above
bug. However, I've neither compiled/tested it as I do not have the necessary
tools. If this kind of a submission breaks the rules for submitting patches,
I apologize and hope somebody else will actually fix it. The patch is a
check around the code that builds the reason parameter to see if there is
some more data left to be parsed.

Thanks,
Arjun


*** packet-rtcp-old.c	Thu Jan 10 15:56:27 2002
--- packet-rtcp.c		Thu Jan 10 15:58:58 2002
***************
*** 386,403 ****
                offset += 4;
        }

!       /* Bye reason consists of an 8 bit length l and a string with length
l *
/
!       reason_length = tvb_get_guint8( tvb, offset );
!       proto_tree_add_item( tree, hf_rtcp_ssrc_length, tvb, offset, 1,
FALSE );

!       offset++;

!       reason_text = ( char* ) malloc( reason_length + 1 );
!       for ( counter = 0; counter < reason_length; counter++ ) reason_text[
cou
nter ] = tvb_get_guint8( tvb, offset + counter );
!       /* strncpy( reason_text, pd + offset, reason_length ); */
!       reason_text[ reason_length ] = '\0';
!       proto_tree_add_string( tree, hf_rtcp_ssrc_text, tvb, offset,
reason_leng
th, reason_text );
!       free( reason_text );
!       offset += reason_length;

        return offset;

--- 386,405 ----
                offset += 4;
        }

!       if ( tvb_reported_length_remaining( tvb, offset ) > 0 ) {
!               /* Bye reason consists of an 8 bit length l and a string
with le
ngth l */
!               reason_length = tvb_get_guint8( tvb, offset );
!               proto_tree_add_item( tree, hf_rtcp_ssrc_length, tvb, offset,
1,
FALSE );
!               offset++;

!               reason_text = ( char* ) malloc( reason_length + 1 );
!               for ( counter = 0; counter < reason_length; counter++ )
reason_t
ext[ counter ] = tvb_get_guint8( tvb, offset + counter );
!               /* strncpy( reason_text, pd + offset, reason_length ); */
!               reason_text[ reason_length ] = '\0';
!               proto_tree_add_string( tree, hf_rtcp_ssrc_text, tvb, offset,
rea
son_length, reason_text );
!               free( reason_text );
!               offset += reason_length;
!       }

        return offset;