http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1711
------- Comment #4 from florent.drouin@xxxxxxxxxx 2007-11-06 16:30 GMT -------
The test for the last ERF type is wrong, the last ERF type is for the PAD
record (48) but the last ERF type used, is for AAL2.
So the type 45 (unknown), is not allowed any more.
Here is a patch to solve this issue.
<<
diff -u erf.c.last erf.c
--- erf.c.last 2007-11-06 17:18:34.000000000 +0100
+++ erf.c 2007-11-06 17:26:00.000000000 +0100
@@ -127,13 +127,7 @@
*/
return 0;
}
-
- /* fail on invalid record type, decreasing timestamps or non-zero pad-bits
*/
- /* Not all types within this range are decoded, but it is a first filter
*/
- if (header.type == 0 || header.type > ERF_TYPE_MAX ) {
- return 0;
- }
-
+
/* Skip PAD records, timestamps may not be set */
if (header.type == ERF_TYPE_PAD) {
if (file_seek(wth->fh, packet_size, SEEK_CUR, err) == -1) {
@@ -142,6 +136,16 @@
continue;
}
+ /* fail on invalid record type, decreasing timestamps or non-zero pad-bits
*/
+ /* Not all types within this range are decoded, but it is a first filter
*/
+ if (header.type == 0 || header.type > ERF_TYPE_MAX ) {
+ return 0;
+ }
+ /* The ERF_TYPE_MAX is the PAD record, but the last used type is
ERF_TYPE_AAL2 */
+ if (header.type > ERF_TYPE_AAL2 ) {
+ return 0;
+ }
+
if ((ts = pletohll(&header.ts)) < prevts) {
/* reassembled AAL5 records may not be in time order, so allow 1 sec
fudge */
if (header.type == ERF_TYPE_AAL5) {
>>
--
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.