Trying to parse LUS and LNS files if the protocol version
was "A1" led to them being marked as a malformed packets.
THis is because protocol version A1 LUS and LNS files do
not have the exception timer field. So to fix it, we check if
the protocol version is not A1, and only if it isn't do we try to
parse the exception timer field.
I was hoping to avoid this, since the ptvcursor should already be
implicitly scoped to the tree it is working on. But there are a bunch of
call sites where the passed tree can be NULL (?) and a few places where
the tree is explicitly set/reset after creation, so requiring an
explicit scope is safer.
Avoids global memory pools in favour of ones the compiler can verify.
Testing with tftpConversationError.pcapng attached to issue 10305 revealed this
warning on the console:
GLib-CRITICAL **: 16:47:08.092: g_str_has_suffix: assertion 'str != NULL' failed
The cause is that the filename retrieved from the tftpinfo struct could
potentially be NULL when dissect_a615a_heur is called, for instance if the TFTP
RRQ/WRQ was not captured or not associated with the same conversation as the
DATA packet.
It's interesting that this condition arises from this capture
file... Perhaps the conversation tracking is amiss? To be investigated.
Without knowing the filename, there appears to be no way to meaningfully
dissect the protocol beyond just dissecting just the file length and the
protocol version; For simplicity, I opted to maintain the present behavior and
have the heuristic test fail if the filename is not known.
Jeremy McCormick