On Tue, Jun 8, 2010 at 4:20 PM, Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> wrote:
> gal@xxxxxxxxxxxxx wrote:
>> Log:
>> Bug 3597 - implicit octet string that is constructed causes PRES/FTAM dissect failure
>>
>> Introduced some state to remember last dissected Tag/Length so that they can be recalled if an IMPLICIT tag is encountered and stripped. This allows its to be determined if the value has a constructed value - and so can be reassembled.
>>
>> In this case, it is a IMPLICIT constructed OCTET STRING at the presentation layer.
>>
>> Many thanks to Fred Gruman for identifying - and apologies for the delay in commiting.
>
> This breaks the ANSI TCAP dissector. It now complains "BER Error:
> OctetString expected but class:CONTEXT(2) primitive tag:21 was
> unexpected" and then the packet is marked as unreassembled.
I'm also having problem with this patch. Have a look at this packet
which is marked as "[Unreassembled Packet]", while it used to display
fine with a "single-ASN1-type" in PRES.
Graeme: are you able to look at this?
--
Stig Bjørlykke