From fb1e26fe6a6d333572cd7d448c6a9c58fd81dbd0 Mon Sep 17 00:00:00 2001 From: Guy Harris Date: Thu, 17 Jan 2002 06:29:20 +0000 Subject: Use the "fragmented" field of the "packet_info" structure in "dissect_frame()" to indicate whether a ReportedBoundsError was due to the packet being malformed (i.e., the packet was shorter than it's supposed to be, so the dissector went past the end trying to extract fields that were supposed to be there) or due to it not being reassembled (i.e., the packet was fragmented, and we didn't reassemble it, but just treated the first fragment as the entire packet, so the dissector went past the end trying to extract fields that were partially or completely in fragments after that). Mark the latter as being unreasembled rather than malformed. Properly initialize, save, and restore that field, and properly set it, so that works. svn path=/trunk/; revision=4555 --- packet-frame.c | 39 ++++++++++++++++++++++++++++++++------- 1 file changed, 32 insertions(+), 7 deletions(-) (limited to 'packet-frame.c') diff --git a/packet-frame.c b/packet-frame.c index 951844a2a2..c95a2823c6 100644 --- a/packet-frame.c +++ b/packet-frame.c @@ -2,7 +2,7 @@ * * Top-most dissector. Decides dissector based on Wiretap Encapsulation Type. * - * $Id: packet-frame.c,v 1.17 2002/01/08 07:17:55 guy Exp $ + * $Id: packet-frame.c,v 1.18 2002/01/17 06:29:16 guy Exp $ * * Ethereal - Network traffic analyzer * By Gerald Combs @@ -45,6 +45,7 @@ static int hf_frame_p2p_dir = -1; static int hf_frame_file_off = -1; static int proto_short = -1; int proto_malformed = -1; +static int proto_unreassembled = -1; static gint ett_frame = -1; @@ -157,10 +158,29 @@ dissect_frame(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) "[Short Frame: %s]", pinfo->current_proto ); } CATCH(ReportedBoundsError) { - if (check_col(pinfo->cinfo, COL_INFO)) - col_append_str(pinfo->cinfo, COL_INFO, "[Malformed Packet]"); - proto_tree_add_protocol_format(tree, proto_malformed, tvb, 0, 0, - "[Malformed Packet: %s]", pinfo->current_proto ); + if (pinfo->fragmented) { + /* + * We were dissecting an unreassembled fragmented + * packet when the exception was thrown, so the + * problem isn't that the dissector expected + * something but it wasn't in the packet, the + * problem is that the dissector expected something + * but it wasn't in the fragment we dissected. + */ + if (check_col(pinfo->cinfo, COL_INFO)) + col_append_str(pinfo->cinfo, COL_INFO, + "[Unreassembled Fragmented Packet]"); + proto_tree_add_protocol_format(tree, proto_unreassembled, + tvb, 0, 0, "[Unreassembled Fragmented Packet: %s]", + pinfo->current_proto ); + } else { + if (check_col(pinfo->cinfo, COL_INFO)) + col_append_str(pinfo->cinfo, COL_INFO, + "[Malformed Packet]"); + proto_tree_add_protocol_format(tree, proto_malformed, + tvb, 0, 0, "[Malformed Packet: %s]", + pinfo->current_proto ); + } } ENDTRY; } @@ -224,11 +244,16 @@ proto_register_frame(void) proto_short = proto_register_protocol("Short Frame", "Short frame", "short"); proto_malformed = proto_register_protocol("Malformed Packet", "Malformed packet", "malformed"); + proto_unreassembled = proto_register_protocol( + "Unreassembled Fragmented Packet", + "Unreassembled fragmented packet", "unreassembled"); - /* "Short Frame" and "Malformed Packet" aren't really protocols, - they're error indications; disabling them makes no sense. */ + /* "Short Frame", "Malformed Packet", and "Unreassembled Fragmented + Packet" aren't really protocols, they're error indications; + disabling them makes no sense. */ proto_set_cant_disable(proto_short); proto_set_cant_disable(proto_malformed); + proto_set_cant_disable(proto_unreassembled); /* Our preferences */ frame_module = prefs_register_protocol(proto_frame, NULL); -- cgit v1.2.3