Wireshark-bugs: [Wireshark-bugs] [Bug 8569] New: Warnings for MCC MNC fields containing non-deci
Date: Mon, 08 Apr 2013 11:25:34 +0000
Bug ID | 8569 |
---|---|
Summary | Warnings for MCC MNC fields containing non-decimal digits |
Classification | Unclassified |
Product | Wireshark |
Version | 1.9.x (Experimental) |
Hardware | All |
OS | All |
Status | UNCONFIRMED |
Severity | Enhancement |
Priority | Low |
Component | Dissection engine (libwireshark) |
Assignee | [email protected] |
Reporter | [email protected] |
Created attachment 10567 [details] Test Case Build Information: wireshark 1.9.3 (SVN Rev 48788 from /trunk) Copyright 1998-2013 Gerald Combs <[email protected]> and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Compiled (32-bit) with GTK+ 2.22.0, with Cairo 1.10.0, with Pango 1.28.2, with GLib 2.26.1, with libpcap, with libz 1.2.3.4, without POSIX capabilities, without libnl, without SMI, without c-ares, without ADNS, without Lua, without Python, without GnuTLS, without Gcrypt, without Kerberos, without GeoIP, without PortAudio, with AirPcap. Running on Linux 2.6.35-22-generic, with locale en_IN, with libpcap version 1.1.1, with libz 1.2.3.4, without AirPcap. Built using gcc 4.4.5. -- Currently warnings are thrown whenever the dissection engine comes across MCC and MNC containing non decimal digits. But for certain cases when MS has its deleted Location Area Information information, these fields may have valid hexadecimal digits. As per specifications: """ In abnormal cases, the MNC stored in the mobile station can have: - digit 1 or 2 not in the set {0, 1 ... 9}, or - digit 3 not in the set {0, 1 ... 9, F} hex. In such cases the mobile station shall transmit the stored values using full hexadecimal encoding. When receiving such an MNC, the network shall treat the LAI as deleted. """ Currently warnings are being triggered when MS is doing a fresh GPRS attach towards the network. One way to remove the warnings for at least these cases are to do following changes in packet-gsm_a_dtap.c and packet-e212.c (I am not sure whether the warnings were purposefully implemented to notify the user about these cases too; in which case please invalidate the bug :)): --- packet-gsm_a_dtap.c 2013-04-08 16:13:30.932953452 +0530 +++ packet-gsm_a_dtap.c_orig 2013-04-08 15:27:16.564754235 +0530 @@ -6366,7 +6366,8 @@ gint ti; int hf_idx; gboolean nsd; - gboolean isGPRSAttachPacket; + + len = tvb_length(tvb); if (len < 2) @@ -6458,10 +6459,6 @@ case 8: get_gmm_msg_params(oct, &msg_str, &ett_tree, &hf_idx, &dtap_msg_fcn); - if ( !strcmp(msg_str,"Attach Request") || !strcmp(msg_str,"Routing Area Update Request")) - { isGPRSAttachPacket = TRUE; - pinfo->private_data = &isGPRSAttachPacket; - } break; case 9: --- packet-e212.c 2013-04-08 16:32:13.859066255 +0530 +++ packet-e212.c_orig 2013-04-08 15:27:17.288724764 +0530 @@ -2529,7 +2529,7 @@ mnc = 100 * mnc3 + mnc; } item = proto_tree_add_uint(tree, hf_E212_mcc , tvb, start_offset, 2, mcc ); - if (((mcc1 > 9) || (mcc2 > 9) || (mcc3 > 9)) && !(pinfo->private_data) ) + if ((mcc1 > 9) || (mcc2 > 9) || (mcc3 > 9)) expert_add_info_format(pinfo, item, PI_MALFORMED, PI_WARN, "MCC contains non-decimal digits"); if (mnc3 != 0x0f) { @@ -2560,7 +2560,7 @@ val_to_str_ext_const(mcc * 1000 + mnc, &mcc_mnc_codes_ext, "")); } - if (((mnc1 > 9) || (mnc2 > 9) || ((mnc3 > 9) && (mnc3 != 0x0f))) && !(pinfo->private_data) ) + if ((mnc1 > 9) || (mnc2 > 9) || ((mnc3 > 9) && (mnc3 != 0x0f))) expert_add_info_format(pinfo, item, PI_MALFORMED, PI_WARN, "MNC contains non-decimal digits"); return mcc_mnc_str; @@ -2649,7 +2649,7 @@ } item = proto_tree_add_uint(tree, hf_E212_mcc , tvb, start_offset, 2, mcc ); - if (((mcc1 > 9) || (mcc2 > 9) || (mcc3 > 9)) && !(pinfo->private_data) ) + if ((mcc1 > 9) || (mcc2 > 9) || (mcc3 > 9)) expert_add_info_format(pinfo, item, PI_MALFORMED, PI_WARN, "MCC contains non-decimal digits"); if (long_mnc) @@ -2663,7 +2663,7 @@ val_to_str_ext_const(mcc * 1000 + 10 * mnc, &mcc_mnc_codes_ext, "Unknown"), mnc); - if (((mnc1 > 9) || (mnc2 > 9) || (long_mnc && (mnc3 > 9))) && !(pinfo->private_data)) + if ((mnc1 > 9) || (mnc2 > 9) || (long_mnc && (mnc3 > 9))) expert_add_info_format(pinfo, item, PI_MALFORMED, PI_WARN, "MNC contains non-decimal digits"); if (long_mnc)
You are receiving this mail because:
- You are watching all bug changes.
- Follow-Ups:
- [Wireshark-bugs] [Bug 8569] Warnings for MCC MNC fields containing non-decimal digits
- From: bugzilla-daemon
- [Wireshark-bugs] [Bug 8569] Warnings for MCC MNC fields containing non-decimal digits
- From: bugzilla-daemon
- [Wireshark-bugs] [Bug 8569] Warnings for MCC MNC fields containing non-decimal digits
- From: bugzilla-daemon
- [Wireshark-bugs] [Bug 8569] Warnings for MCC MNC fields containing non-decimal digits
- Prev by Date: [Wireshark-bugs] [Bug 8561] 802.11 QoS decode broken
- Next by Date: [Wireshark-bugs] [Bug 4842] H.248 Annex E dissector does not properly dissect event parameters
- Previous by thread: [Wireshark-bugs] [Bug 2422] The "Wireless Settings" toolbar should support non-AirPcap adapters
- Next by thread: [Wireshark-bugs] [Bug 8569] Warnings for MCC MNC fields containing non-decimal digits
- Index(es):