osmocom
/
wireshark
14
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

IEC-60870-5-104: apci type endianness bugfix 

The type field in the IEC-60870-5-104 header is parsed wrongly. The type is
encoded in the headers third byte: I.e. a U-frame is encoded as xxxxxx11b, a
S-frame as xxxxxx01b and an I-frame as xxxxxxx0b. Yet the current parser reads
the information from the MSB.
This commit is contained in:
Konrad Wolsing 2022-03-11 15:55:32 +01:00 committed by A Wireshark GitLab Utility
parent 676ed85296
commit f9ee2c14a0
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
epan/dissectors/packet-iec104.c
View File

@ -2105,9 +2105,9 @@ static int dissect_iec60870_104(tvbuff_t *tvb, packet_info *pinfo, proto_tree *t
type = temp8 & 0x03;
if (type == I_TYPE)
proto_tree_add_bits_item(it104tree, hf_apcitype, tvb, (Off + 2) * 8 + 7, 1, ENC_LITTLE_ENDIAN);
proto_tree_add_bits_item(it104tree, hf_apcitype, tvb, (Off + 2) * 8 + 7, 1, ENC_BIG_ENDIAN);
else
proto_tree_add_bits_item(it104tree, hf_apcitype, tvb, (Off + 2) * 8 + 6, 2, ENC_LITTLE_ENDIAN);
proto_tree_add_bits_item(it104tree, hf_apcitype, tvb, (Off + 2) * 8 + 6, 2, ENC_BIG_ENDIAN);
if (len <= APDU_MAX_LEN) {
wmem_strbuf_append_printf(res, "%s %s ",