From d149d98fc375e8d0ad44aa9983e6c79968cc68d7 Mon Sep 17 00:00:00 2001 From: Ronnie Sahlberg Date: Sat, 26 Nov 2005 00:34:22 +0000 Subject: [PATCH] assume the four bytes after the fid in notify request is the completion mask svn path=/trunk/; revision=16596 --- epan/dissectors/packet-smb.c | 2 +- epan/dissectors/packet-smb.h | 1 + epan/dissectors/packet-smb2.c | 7 +++++-- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/epan/dissectors/packet-smb.c b/epan/dissectors/packet-smb.c index 31e290fc9b..9a6385da4e 100644 --- a/epan/dissectors/packet-smb.c +++ b/epan/dissectors/packet-smb.c @@ -7175,7 +7175,7 @@ dissect_nt_create_options(tvbuff_t *tvb, proto_tree *parent_tree, int offset) return offset; } -static int +int dissect_nt_notify_completion_filter(tvbuff_t *tvb, proto_tree *parent_tree, int offset) { guint32 mask; diff --git a/epan/dissectors/packet-smb.h b/epan/dissectors/packet-smb.h index 401e642fdc..f654bf72f5 100644 --- a/epan/dissectors/packet-smb.h +++ b/epan/dissectors/packet-smb.h @@ -316,5 +316,6 @@ extern int dissect_qfi_SMB_FILE_ALIGNMENT_INFO(tvbuff_t *tvb, packet_info *pinfo extern int dissect_qfi_SMB_FILE_COMPRESSION_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc); extern int dissect_qfi_SMB_FILE_NETWORK_OPEN_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc); extern int dissect_qfi_SMB_FILE_ATTRIBUTE_TAG_INFO(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset, guint16 *bcp, gboolean *trunc); +extern int dissect_nt_notify_completion_filter(tvbuff_t *tvb, proto_tree *parent_tree, int offset); #endif diff --git a/epan/dissectors/packet-smb2.c b/epan/dissectors/packet-smb2.c index c6b7583ce4..b2c4c44e5d 100644 --- a/epan/dissectors/packet-smb2.c +++ b/epan/dissectors/packet-smb2.c @@ -1556,9 +1556,12 @@ dissect_smb2_notify_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, /* fid */ offset = dissect_smb2_fid(tvb, pinfo, tree, offset, si, FID_MODE_USE); + /* completion filter */ + offset = dissect_nt_notify_completion_filter(tvb, tree, offset); + /* some unknown bytes */ - proto_tree_add_item(tree, hf_smb2_unknown, tvb, offset, 8, TRUE); - offset += 8; + proto_tree_add_item(tree, hf_smb2_unknown, tvb, offset, 4, TRUE); + offset += 4; return offset; }