Wireshark-dev: [Wireshark-dev] Changes in the latest dev code (since 4.4.7) which heavily impac

From: Tamás Regős <regost@xxxxxxxxx>
Date: Wed, 25 Jun 2025 16:13:30 +0700
Hi Developers,

The attached ~30KB large pcap file has 1 NR RRC packet and the current latest official WS version 4.4.7 can decode it properly. This is good.

However, when I try to open and decode it with the latest development version, it fails (Version 4.5.0 (6f13ac41b7df)).
(I just refetched the whole source code and recompiled again from scratch).

CLI:
 ** (wireshark:16076) 14:01:27.439488 [Epan WARNING] -- Dissector bug, protocol NR RRC, in packet 1: ...\wireshark\epan\proto.c:6841: failed assertion "((tree)->tree_data)->start_idle_count < 50000" (nr-rrc.BandParameters_v1540_element)

GUI:
[Dissector bug, protocol NR RRC: ...\wireshark\epan\proto.c:6841: failed assertion "((tree)->tree_data)->start_idle_count < 50000" (nr-rrc.BandParameters_v1540_element)]
    [Expert Info (Error/Dissector bug): ...\wireshark\epan\proto.c:6841: failed assertion "((tree)->tree_data)->start_idle_count < 50000" (nr-rrc.BandParameters_v1540_element)]
        [...\wireshark\epan\proto.c:6841: failed assertion "((tree)->tree_data)->start_idle_count < 50000" (nr-rrc.BandParameters_v1540_element)]
        [Severity level: Error]
        [Group: Dissector bug]



It seems whatever changes could have been done in packet-nr-rrc.c (or somewhere else?) it did heavily impact the start_idle_count (or when it's reset) and the "PROTO_TREE_MAX_IDLE 50000" in proto.c is not enough anymore.

I was testing with higher values and ended up with "PROTO_TREE_MAX_IDLE 93100" to make it work and be able to decode the packet (93000 still failed).

That is a significant issue, I believe.

Could anyone please have a look at what could be the underlying issue?

Thank you.

Regards,
Tamas

Attachment: large.pcapng
Description: Binary data