First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

About the enum type of per decode

  • retag add tags

In the function of packet-per.c, dissect_per_enumerated,when there is only one element in the extension part, why not need to decode the element?

the responding code is as follows:

......
if (ext_num == 1) {
    /* 10.5.4   If "range" has the value 1,
     * then the result of the encoding shall be
     * an empty bit-field (no bits).
     */
    enum_index = 0;
}
......

the above regulation cannot be seen in the enum type of per decode regulation

updated 2018-09-06 11:25:09 +0000
This post is a wiki. Anyone with karma >750 is welcome to improve it.
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

2 Answers

0

This is indeed a bug in Wireshark, thanks for reporting it. The fix is available here: https://code.wireshark.org/review/c/2... and will be backported in all the active branches.

Pascal Quantin's avatar
5.8k
Pascal Quantin
answered 2018-09-07 07:44:55 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments
0

Hi,

It comes from the definition of a constrained whole number encoding in ITU X.691 chapter 11.5.4 (Wireshark comment is based on an earlier X.691 specification where the corresponding chapter was 10.5.4).

Pascal Quantin's avatar
5.8k
Pascal Quantin
answered 2018-09-06 17:51:40 +0000
edit flag offensive 0 remove flag delete link

Comments

In the ITU X.691 ,I think the enum type of per decode regulation should be as follows In the presence of an extension marker,if the value is not in the extension root it is encoded as a normally small non-negative whole number , not as a constrained whole number

liwsh880709's avatar liwsh880709 (2018-09-07 04:48:57 +0000) edit

So do you have a pcap triggering this code that we could use to double check the behavior?

Pascal Quantin's avatar Pascal Quantin (2018-09-07 06:13:03 +0000) edit

Hi, after a second thought I agree with you: this specific case should be removed so as to systematically use the small non-negative whole number encoding. I'm gonna fix it right now, thanks for raising the point.

Pascal Quantin's avatar Pascal Quantin (2018-09-07 07:36:04 +0000) edit
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer