Wireshark-bugs: [Wireshark-bugs] [Bug 8994] Field value is wrong

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Tue, 30 Jul 2013 07:34:34 +0000

changed bug 8994

What Removed Added
Status UNCONFIRMED CONFIRMED
CC   [email protected]
Ever confirmed   1

Comment # 3 on bug 8994 from 
(In reply to comment #2)
> The value in "Packet bytes" is 0x2000. The field specified and displayed in
> "Packet details" is defined as masked UINT16 with mask 0x6000.

The problem here is that this field (and several others I believe) has
bit_length 2 in the FieldPart definition, which is resolved to 1 byte in
asterix_build_subtree() where the items are added to the tree.  Wireshark will
then use 1 byte length when fetching the value and you will get this result:

mask:   0110 0000 0000 0000 (0x6000)
value:  0000 0000 0010 0000 (0x0020)
result:  00

It seems like the code is parsing one byte at the time, which is wrong for some
fields.

You are receiving this mail because:
  • You are watching all bug changes.