osmocom
/
wireshark
11
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

DNS: WKS RR Protocol field is read as 4 bytes instead of 1 

In the attached pcap file, there's a single DNS packet with WKS RR in the Prerequisites section.
The Protocol field of this RR is read as if it is 4 bytes long instead of 1, which actually reads part of the bytes of the following RR.

Found by boaz

Bug:10675
Change-Id: Icf12c7f3864b629a242598373c06eee4de0ca098
Reviewed-on: https://code.wireshark.org/review/5170
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
This commit is contained in:
Alexis La Goutte 2014-11-07 15:32:53 +01:00 committed by Anders Broman
parent de37217933
commit aec5ffb535
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
epan/dissectors/packet-dns.c
View File

@ -1919,7 +1919,7 @@ dissect_dns_answer(tvbuff_t *tvb, int offsetx, int dns_data_offset,
cur_offset += 4;
rr_len -= 4;
proto_tree_add_item(rr_tree, hf_dns_wks_protocol, tvb, cur_offset, 4, ENC_BIG_ENDIAN);
proto_tree_add_item(rr_tree, hf_dns_wks_protocol, tvb, cur_offset, 1, ENC_BIG_ENDIAN);
protocol = tvb_get_guint8(tvb, cur_offset);
cur_offset += 1;
rr_len -= 1;