commit 7223fac3d52
Author: Gerald Combs <gerald@wireshark.org>
Date:   Tue Aug 11 13:17:08 2026 -0700

    CMake: Update libssh to 0.12.2

    (cherry picked from commit ff6b064137c56625813f7eb7bae9497fc79d4ed2)

commit 1b632180a1b
Author: Gerald Combs <gerald@wireshark.org>
Date:   Mon Aug 10 16:08:16 2026 -0700

    Prep for 4.6.8

commit d9465ec6d05
Author: Stig Bjørlykke <stig@bjorlykke.org>
Date:   Mon Aug 10 14:12:47 2026 +0000

    gsm_sim: Fix SELECT P2 parsing

    Handle the first P2 bit is RFU.
    Fix value strings for session control bits.

    (cherry picked from commit d53e69e9ce09f42780b60f7ceeab648a5a368e8d)

    Co-authored-by: Stig Bjørlykke <stig@bjorlykke.org>

commit 3175cf0a77e
Author: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Date:   Wed Aug 5 23:29:51 2026 +1000

    Fix potential heap corruption in UMTS RRC

    Fixes #21478

    Signed-off-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
    (cherry picked from commit a44c8dc01cac93fca23debab465298fc08b06658)

commit b302764efd2
Author: John Thacker <johnthacker@gmail.com>
Date:   Sun Aug 9 16:20:18 2026 -0400

    BT AVRCP: Do not overflow on too large reassemblies

    If the total reassembled size of a PDU would overflow, truncate at a value.
    Similar to #21423 / 9f68da57d360629eb7cee8d97d2f894b4858ce8f, stop at
    INT32_MAX for now until unsigned lengths can be handled for tvbuffers
    everywhere. This prevents allocating a buffer that is in reality too short.
    Add a warning field (use a field instead of a expert info to make this
    similar to the standard reassembly API, which perhaps should be used in
    the future.)

    Thanks to both AISLE Research and Feng Xue for independently reporting
    this issue and providing PoCs and proposed fixes.

    Fix #21488.

    (backported from commit 1b599808322109ddbac92dd4d81c41ef09bea488)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit 7a868d2c7a6
Author: John Thacker <johnthacker@gmail.com>
Date:   Sun Aug 9 16:14:18 2026 -0400

    Wiretap: DCT3 Trace: Avoid overflow with extra <l2> elements

    A proper Gammu DCT3 trace file only has a single child <l2> element
    for a given <l1> element. The previous parser ignored such <l2> child
    elements after the first it found with data. We could do more to call
    this a bad file.

    Also fix not freeing the XML document in one error path, and test
    version greater than or equal to a bounds instead of just equal.

    Fix #21475

    Thanks to Pedro Pinho for reporting

    (cherry picked from commit c3e931321e289c33c14a2aa5ffa56962f99fb7d1)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit 488e5fb62b5
Author: John Thacker <johnthacker@gmail.com>
Date:   Sun Aug 9 15:34:20 2026 -0400

    btavrcp: Fix Coverity Dereference null return value

    Fix Coverity Dereference null return value warning

    Add a condition to check that data_fragment is not NULL.

    Coverity CID 1405201

    AI-Assisted: no

    (cherry picked from commit 8841ffbe83d2055ed83b9b91329d5b2bf0b01347)

    Co-authored-by: infostam GitHub <github@infostam.com>

commit c93e306dcf3
Author: Gerald Combs <gerald@wireshark.org>
Date:   Sun Aug 9 10:13:49 2026 +0000

    [Automatic update for 2026-08-09]

    Update manuf, services, enterprise numbers, translations, and other items.

commit 8177674fb82
Author: Chuck Craft <bubbasnmp@gmail.com>
Date:   Fri Aug 7 12:30:28 2026 +0000

    daintree: validate timestamp fraction

    Fixes #21473

    (cherry picked from commit a78713609bee82268b95c441aa4bf1ea6719dfbd)

    (cherry picked from commit e15834c812a11e66840e548d1a79fa117d49c787)

    Co-authored-by: Chuck Craft <bubbasnmp@gmail.com>

commit 61469331d74
Author: Pascal Quantin <pascal@wireshark.org>
Date:   Thu Aug 6 13:45:38 2026 +0200

    NAS 5GS: fix dissection of type 1 service-level-AA parameter

    Fixes #21479

    (cherry picked from commit 077d999dff577ba4c60dff981e5e448cac8a7fc3)

commit 2ed150ddb00
Author: Pascal Quantin <pascal@wireshark.org>
Date:   Wed Aug 5 12:05:44 2026 +0200

    NAS 5GS: fix a copy/paste error in SOR transparent container dissection

    Fixes #21477

    (cherry picked from commit 35a0df6e8e889433d5f7db99f16f9b627864182a)

    Co-authored-by: Pascal Quantin <pascal@wireshark.org>

commit 0543da5b412
Author: Pascal Quantin <pascal@wireshark.org>
Date:   Tue Aug 4 21:16:51 2026 +0200

    NAS 5GS: fix SOR transparent container dissection

    Fixes #21472

    (cherry picked from commit 1dbdfdc340809da28afcf7b448b61a1d21f9d0ba)

    Co-authored-by: Pascal Quantin <pascal@wireshark.org>

commit d77dcfd071a
Author: John Thacker <johnthacker@gmail.com>
Date:   Sun Aug 2 19:43:53 2026 -0400

    ESS: Avoid DISSECTOR_ASSERTing on a zero length BIT STRING

    The VAL_PTR from dissecting a BIT STRING can be uninitialized without
    throwing an exception, notably in the zero length case. That likely
    will call a DISSECTOR_ASSERT later with most compilers (but because
    the parameter tvb was not initialized to NULL, it may not, particularly
    under testing.)

    Fix #21467

    Thanks to AISLE Research for the report and suggested fix

    (backported from commit affa11c6256fd697bc451e8c0139ff6230e7858a)

commit 179c1d24c03
Author: Peter Wu <peter@lekensteyn.nl>
Date:   Tue Aug 4 01:31:56 2026 +0200

    x509if: fix null-pointer dereference on invalid nested RDN

    A RDN nested within a RDN is malformed and creates a nested call to
    `dissect_x509if_RelativeDistinguishedName`. The inner dissection resets
    `last_rdn_buf` to NULL, causing a NULL-pointer deref in the outer call.

    Fix this by gracefully handling the outcome. `last_dn_buf` seems
    similar, but is unaffected as it doesn't reset to NULL after dissection.

    Fixes #21469

    Fixes: v4.1.0rc0-821-g59ee5247dc ("X509IF: Fix string truncation")
    (cherry picked from commit 340b45bcb2a9cabe7b33562ebefbe7a6d7bea0ee)

commit 29c8a97a93a
Author: John Thacker <johnthacker@gmail.com>
Date:   Sun Aug 2 14:24:42 2026 -0400

    ERF: Don't further truncate truncated packets below 0

    The ERF format requires that the actual captured length
    present (including some ERF headers) be 64-bit aligned.
    When a frame is already truncated below the reported wire
    length, the ERF dumper has to truncate the frame further
    instead of padding, because otherwise the padding would be
    interpreted as the missing truncated bytes. If this would
    make the length to be written go below zero, report an error
    and refuse to write the record.

    Fix #21466

    Thanks to AISLE Security for the report, PoC, and proposed fix.

    (cherry picked from commit 6393b5bd637ab336f07f3d8d6709cc8fc7d4c9f4)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit ccd12dd4920
Author: John Thacker <johnthacker@gmail.com>
Date:   Sun Aug 2 14:25:15 2026 -0400

    SSH: Check Curve25519 key lengths

    crypto_scalarmult_curve25519 requires that the key lengths be the
    correct size (32 bytes), so check that before calling in case the
    Decryption Secrets Block has a bogus length.

    Fix #21465

    Thanks to Vivek Parikh of BreachX Zero Day Labs, using Typhon AI Mil v2,
    for the report.

    (cherry picked from commit 3f38ce6c3740d3553ef682c19da5e413af6b61ce)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit 80460801fcf
Author: John Thacker <johnthacker@gmail.com>
Date:   Sun Aug 2 13:39:33 2026 -0400

    erf: do unsigned artihmetic for byte counts.

    AI-Assisted: no

    (cherry picked from commit 4a0fca61ea6d1efa0434e5bd54510331e26decec)

    Co-authored-by: Guy Harris <gharris@sonic.net>

commit e8afbfd27b2
Author: Gerald Combs <gerald@wireshark.org>
Date:   Sun Aug 2 10:22:30 2026 +0000

    [Automatic update for 2026-08-02]

    Update manuf, services, enterprise numbers, translations, and other items.

commit 96eaba7490d
Author: John Thacker <johnthacker@gmail.com>
Date:   Sat Aug 1 21:23:53 2026 -0400

    androiddump: Avoid overflow in btsnoop reported or captured lengths

    The btsnoop file format, derived, from the Sun snoop format, features
    32-bit unsigned values for reported and captured lengths. It is
    extremely unlikely that real values will be in the top half of the
    range, and thus convert to negative numbers if cast to signed 32-bit
    integers, but a hostile or buggy Android Debug Bridge service could
    do so. Guard against that.

    Decode record lengths as unsigned values, reject impossible records before
    length arithmetic, and use the validated values for dumping and buffering.

    Assisted-by: AISLE:Snapshot

    Fix #21464

    Thanks to Aisle Security for the report, PoC, and proposed fix.

    (cherry picked from commit 3c221601fd471c457dd23c414cd5090980d3d99d)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit 8a3cbd7b91f
Author: Chuck Craft <bubbasnmp@gmail.com>
Date:   Sat Aug 1 12:39:29 2026 +0000

    bblog: check for truncated option block

    Fixes: #21460

    (cherry picked from commit c72babdb036b2c1f9a3efb0a9ba5e188e224c73f)

    Co-authored-by: Chuck Craft <bubbasnmp@gmail.com>

commit 1360d97cb32
Author: John Thacker <johnthacker@gmail.com>
Date:   Fri Jul 31 11:33:42 2026 -0400

    wsjon: Make json_get_next_object iterative

    The current implementation is recursive, albeit probably optimized
    considerably in most build types. Replace it with an iterative
    implementation to reduce stack use, especially in an ASan Debug build.

    Fix #21462

    Thanks to Aisle Security for the report, PoC, and proposed fix.

    (cherry picked from commit 35d9347975451d5a57af8cc1514af7657f7ef02f)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit 673825ca6d7
Author: John Thacker <johnthacker@gmail.com>
Date:   Thu Jul 30 20:10:27 2026 -0400

    ngsniffer: Don't read past the actual buffer read

    Pass in the number of bytes we read (which was limited to 256),
    not the total remaining length, to the header processing function.
    Fix it in both paths, even though it doesn't matter in one.

    Fix #21461

    Thanks to AISLE Security for the report, PoC, and proposed fix.

    (cherry picked from commit 5b624b9c3a4c0b14ffe25300842e741cf3cf37d4)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit e6320512dc3
Author: John Thacker <johnthacker@gmail.com>
Date:   Thu Jul 30 12:21:07 2026 -0400

    CMS: Move globals into packet private data

    This prevents reusing the proto_trees in a later frame, or having
    to add a frame end routine, in the case of unusual non-spec
    compliant captures.

    Thanks to AISLE Security for the reports, PoCs, and proposed fixes.

    Fix #21457, #21458

    (backported from commit 70b341567adb8b7bae0268b7a6fe61f1374073d6)

commit 663e527ddcc
Author: John Thacker <johnthacker@gmail.com>
Date:   Thu Jul 30 10:14:57 2026 -0400

    wsutil: pint: Fix width of phtoleu16 value in one path

    On the code path that uses memcpy (required for MSVC and some
    versions of the Intel compiler to optimize properly), the width
    of the value parameter intended to be 16-bit is 32-bit. This can
    cause out of bounds reads or writes.

    This was probably a copy-and-pasteo or similar.

    Fix #21455

    (backported from commit 86336b8332fe2e8f11127733aa0f8713721b4207)

commit f41e4d1ecfa
Author: John Thacker <johnthacker@gmail.com>
Date:   Thu Jul 30 10:36:01 2026 -0400

    wiretap: log3gpp: Use proper bounds for writing

    Fix the loop bound when procesing hexstring data. Note this
    requires very specific packet lengths in the data due to how
    the wiretap buffers are allocated.

    Thanks to AISLE Security for the report, PoC, and proposed fix.

    Fix #21454

    (cherry picked from commit c5f900e92227495ff944356f25523c530a277900)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit 907c6ab2200
Author: John Thacker <johnthacker@gmail.com>
Date:   Wed Jul 29 18:20:45 2026 -0400

    BT BR/EDR: Register reassembly table

    Thanks to Aisle Security for the report, PoC, and proposed fix.

    Fix #21452

    (cherry picked from commit 0e191266dd14ff099f91d051cdf34ff4ae1e0571)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit 068d179d5f6
Author: John Thacker <johnthacker@gmail.com>
Date:   Wed Jul 29 14:10:03 2026 -0400

    BT HFP: Check the length of the +XAPL first parameter

    Check the length of the first parameter of the HFP Command AT+XAPL
    before trying to parse hex strings out of the raw array.

    https://developer.apple.com/accessories/Accessory-Design-Guidelines.pdf

    Thanks to AISLE Security for the report, PoC, and suggested patch.

    Fix #21451

    (cherry picked from commit fc4171f4ddf75b4f243f392f0ea093e8962fcb73)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit 848f415af2b
Author: John Thacker <johnthacker@gmail.com>
Date:   Wed Jul 29 07:10:56 2026 -0400

    kerberos: Add a function to print up to the first 4 bytes of a key

    Add a static function to print up to the first 4 bytes of a key
    (with an ellipsis if there are more than 4 bytes, as is likely)
    and use it in the various expert items formats. This avoids having
    to worry if the key is for some reason shorter than 4 bytes.

    Fix #21449

    Thanks to AISLE Security for the report, PoC, and proposed fix.

    (cherry picked from commit 78d67418e8cfec6eb30a80bd399d8485f01efdd3)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit cbf39642d86
Author: John Thacker <johnthacker@gmail.com>
Date:   Tue Jul 28 15:39:01 2026 -0400

    X.509AF: Don't call strstr on NULL

    If the name is missing due to a malformed Certificate, don't call
    strstr on it.

    Thanks to AISLE Security for the report, PoC, and proposed fix.

    Fix #21448

    (cherry picked from commit f08b78f3904c6f3a1a53da582dfa17b81ea9a9c2)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit 73467571b0e
Author: John Thacker <johnthacker@gmail.com>
Date:   Tue Jul 28 15:19:08 2026 -0400

    H.245: Do not update state for a returnedFunction GenericMessage

    In H.245, a returnedFunction is much like an encapsulated original
    datagram in a ICMP error packet. The h245_pi is cleared before
    processing one. In the case that the returnedFunction is a
    GenericMessage it h245_pi should be checked against NULL, and the
    info column and frame label should not be updated. It is checked
    in all the other cases in H.245

    Thanks to AISLE Security for the report, PoC, and suggested patch.

    Fix #21447

    (cherry picked from commit 86df5f3b401f77dbbaf02d7dc1af39b820b2b489)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit f4bf09ffdd1
Author: John Thacker <johnthacker@gmail.com>
Date:   Tue Jul 28 11:55:58 2026 -0400

    wiretap: RTPDump: Fix swapped caplen / len

    Also check to make sure that the total packet length, which
    includes the mandatory 8-byte header, is at least 8.

    Fix #21445

    Thanks to Be33eD for the report and PoC.

    (cherry picked from commit 613fdd1682bd307f82d2ed5d2efc2866b88f2085)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit fdcae73419f
Author: John Thacker <johnthacker@gmail.com>
Date:   Tue Jul 28 09:02:28 2026 -0400

    CMS: Check if Digest Algorithm is NULL

    Check for the Digest Algorithm being NULL. (g_strcmp0 could
    also be used instead.)

    Also, clear the old digest algorithm at the start of dissecting
    an AlgorithmIdentifier instead of after dissecting the OID, in
    case there is an exception, etc. to avoid stale data. Do this before
    the sequence processing, in case of an empty sequence. (The BER
    dissector probably should check for missing mandatory elements
    for SEQUENCE as it appears to do for SET.)

    Thanks to AISLE Research for the report, PoC, and proposed mitigation.

    Fix #21446

    (backported from commit 02dd1e7af093163feae29ef1937caef24da54d17)

commit b8d20ab8165
Author: John Thacker <johnthacker@gmail.com>
Date:   Tue Jul 28 10:20:03 2026 -0400

    KNX/IP: Prevent NULL dereference by using tvb_get_ptr call correctly

    The size variable is already the length of the encrypted data, so
    the offset does not need to be subtracted a second time. The size
    was verified by tvb_get_captured_length_remaining and checked before
    each subtraction, so size bytes (which must be at least 16) are
    always present.

    tvb_get_ptr() returns a raw pointer into the data, so the length
    value at the end being shorter than the desired size only matters
    for the verification step (not needed here because the size has
    already been verified) not the length of the returned pointer,
    except in the case where the value after subtraction becomes 0 and
    the returned pointer is NULL.

    Thanks to Be33eD for the report and PoC.

    Fix #21444

    (cherry picked from commit b42ae78d867ba6acaf1fc8479344ab939f30b834)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit 73ad8b0e0f6
Author: Gerald Combs <gerald@wireshark.org>
Date:   Sun Jul 26 10:13:12 2026 +0000

    [Automatic update for 2026-07-26]

    Update manuf, services, enterprise numbers, translations, and other items.

commit 53c030353b1
Author: John Thacker <johnthacker@gmail.com>
Date:   Sat Jul 25 08:54:04 2026 -0400

    COSEM: Decrement dissection depth after recursion

    Decrement the compact-array TypeDescription depth only after its child
    has returned so nested arrays reach the configured dissection limit.

    Thanks to AISLE Security for the report, PoC, and suggested patch.

    Assisted-by: AISLE:Snapshot

    Fix #21442

    (cherry picked from commit 3a1011a2cb6f2d9af2085fd220c0bff05473bcb7)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit 2a7ea46648f
Author: John Thacker <johnthacker@gmail.com>
Date:   Sat Jul 25 08:37:01 2026 -0400

    EAX: Don't truncate lengths

    C12.22 can send 32-bit lengths to the EAX handling to be decrypted.
    The buffer to decrypt is all copied from packet data via tvb_memcpy
    before decryption, so this isn't just a 32-bit length read from packet
    data that doesn't correspond to actual data.

    Don't truncate the lengths. Do checked arithemtic to check for overflow.

    It is unlikely to be larger than a 16-bit value without some kind of
    reassembly, but reassembly is possible since this is over TCP. Return
    false in a few failure cases.

    Fix #21439

    Thanks to AISLE Security for the report, PoC, and suggsted fix (though
    this fix goes in a slightly different direction.)

    (cherry picked from commit 360bdc60fe1084061d4cc98fcdfbe55d9e2cb375)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit 90e30c53f60
Author: John Thacker <johnthacker@gmail.com>
Date:   Sat Jul 25 08:11:28 2026 -0400

    BLF: Don't read past too short (truncated) VLAN-tagged Ethernet frames

    Change an error from internal ("wiretap module bug; this should never
    happen") to unwriteable record data, because captures with Ethernet
    frames truncated before the Ethertype are in fact real.

    Also, might as well check for too long frames (IPv6 Jumbograms? In
    _my_ capture? It's not very likely, really) even though that won't
    actually cause a crash. BLF's Ethernet framing has a payload stored
    in a 16-bit integer; pcap[ng] allows 32-bit lengths.

    Fix #21441

    (cherry picked from commit be522544d0c7ada419b94caa4b6065ace2e8a773)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit cd474f70006
Author: John Thacker <johnthacker@gmail.com>
Date:   Sat Jul 25 07:28:42 2026 -0400

    EAX: Move a static struct onto the stack.

    There's no need to use static storage for the decryption working space; No
    state need be maintained across calls to Eax_Decrypt.  Moving it to the stack
    frees up a tiny amount of .bss but most importantly eliminates the risk of
    concurrency issues.

    Tested using the capture attached to issue #5531.

    (cherry picked from commit bb9bb86070f0e72456e19753ff94863921f94a90)

    Co-authored-by: Darius Davis <darius-wireshark@free-range.com.au>

commit 623f293c06d
Author: John Thacker <johnthacker@gmail.com>
Date:   Fri Jul 24 22:18:57 2026 -0400

    Supply some more unregistered items

    (cherry picked from commit 9b2703cb230534c5376c895a75c7ba1b532675b0)

    9b2703cb Supply some more unregistered items

    Co-authored-by: Martin Mathieson <martin.r.mathieson@googlemail.com>

commit 05e1415c2d7
Author: John Thacker <johnthacker@gmail.com>
Date:   Fri Jul 24 21:09:27 2026 -0400

    k12: Don't try to write records larger than supported for writing

    The Tektronix K12xx (.rf5) wiretap dumper can only write the k12
    encapsulation, but the reader can read files with records larger
    than the dumper can write. Prevent writing past an allocated buffer
    by refusing to write a too long record.

    Also replace a few numeric literals with the appropriate #defines.

    Fix #21436

    Thanks to AISLE Security for the report, PoC, and suggested fix.

    (cherry picked from commit 08dde3f0ed385261d56270fe5289e029a666c6bf)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit 67b2d8b865c
Author: John Thacker <johnthacker@gmail.com>
Date:   Fri Jul 24 11:04:01 2026 -0400

    UMTS-FP: More bounds checking against subframes[]

    (cherry picked from commit 5c5d3d53818a78db8f14ebc46c67b052b6542894)

    16010858 UMTS-FP: More bounds checking against subframes[]

    Co-authored-by: Martin Mathieson <martin.r.mathieson@googlemail.com>

commit 6aba0a890f0
Author: John Thacker <johnthacker@gmail.com>
Date:   Fri Jul 24 09:57:40 2026 -0400

    wiretap: busmaster: Do not exit the program on a malformed file

    Report a malformed header as a bad file and have that handled through
    the normal wiretap error routines, instead of rudely exiting the
    process.

    Fix #21435

    Thanks to AISLE Security and AISLE:Snapshot for the report, PoC and suggested
    patch.

    (cherry picked from commit 8e984f1f8360d90c5250c1a77b8754f3ce64890b)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit 10b09ca64a3
Author: Pascal Quantin <pascal@wireshark.org>
Date:   Thu Jul 23 17:45:27 2026 +0200

    NAS 5GS: add extraneous data check to UE security capability IE

    Fixes #21431

    (cherry picked from commit f2d3d9f070750d1a23b30b5ec231cedf62802a83)

    Co-authored-by: Pascal Quantin <pascal@wireshark.org>

commit 397020bca76
Author: Pascal Quantin <pascal@wireshark.org>
Date:   Thu Jul 23 17:06:09 2026 +0200

    NAS 5GS: fix dissection of extended CAG information list IE

    Fixes #21433

    (cherry picked from commit ba4e7dfb1020673cca0bb497b68765caf9db0789)

    Co-authored-by: Pascal Quantin <pascal@wireshark.org>

commit 71edc56b989
Author: Pascal Quantin <pascal@wireshark.org>
Date:   Thu Jul 23 16:26:17 2026 +0200

    NAS 5GS: fix dissection of registration wait range IE

    Fixes #21432

    (cherry picked from commit 1ada3fc602388e1b8d37cfb008b0ac1278267c58)

    Co-authored-by: Pascal Quantin <pascal@wireshark.org>

commit 0f0312ae2d1
Author: John Thacker <johnthacker@gmail.com>
Date:   Wed Jul 22 09:08:34 2026 -0400

    Qt: QCustomPlot: Fix overflow in QCPItemTracer

    Converting a QRectF to a QRect can cause integer overflow, particularly
    when the QRectF in question has just been radically shifted by a conversion
    from relative times to absolute times. Qt 6.10 added a check for integer
    overflow in QRect and other geometry classes:

    https://github.com/qt/qtbase/commit/1145e1709d1072f7dd45683e9c25a14615603854

    This causes non-UB wraparound Qt is not compiled in Debug mode, but
    causes an Error which leads to Wireshark being aborted when compiled in
    Debug mode. (The wraparound is still incorrect, but also the QRect
    produced by wrapping around is unlikely to intersect, although it
    could.)

    Convert the clipRect to a QRectF before checking the intersection with
    various QRectF, instead of converting the QRectFs to QRects in order to
    avoid overflow.

    Ping #21426

    (cherry picked from commit 2f022fab2cc9523e1407ef7403eec61a873109a7)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit 1360624cc4b
Author: John Thacker <johnthacker@gmail.com>
Date:   Tue Jul 21 17:49:38 2026 -0500

    Qt: Trim off extra attributes from Qt >= 6.11 QFont::toString

    Qt 6.11 added two new attributes to the comma separated list produced
    by QFont::toString(). Older versions have 17 attributes; now there are
    19. (Qt 5 also uses 17 attributes, although the weights numbers are
    different.)

    https://doc.qt.io/qt-6/qfont.html#toString
    https://doc.qt.io/qt-6.10/qfont.html#toString

    Strip extra attributes when running on Qt < 6.11, to avoid console
    warnings like:

    [GUI WARNING] -- QFont::fromString: Invalid description
    'Consolas,9,-1,5,400,0,0,0,0,0,0,0,0,0,0,1,Regular,0,0'`

    This can happen when using the same preferences on multiple versions of
    Wireshark or on multiple computers, only some of which have Qt 6.11.

    Fonts are managed in a different place in 4.6 and earlier, so this
    commit is made directly to 4.6

commit c91e5e16339
Author: Pascal Quantin <pascal@wireshark.org>
Date:   Tue Jul 21 23:36:53 2026 +0200

    DCT2000: fix buffer overflow when copying packet data

    Fixes #21427

    Thanks to Yazan Balawneh from CyStack Security Team for the report

    (cherry picked from commit 46c813e7ad05316afdbb06c1ecb0cf82b7c1c000)

    Co-authored-by: Pascal Quantin <pascal@wireshark.org>

commit 68e3e424a2f
Author: Pascal Quantin <pascal@wireshark.org>
Date:   Sun Jul 19 15:51:38 2026 -0500

    Qt: split stashed preferences treatment in two steps

    When applying new preferences, the call to the function
    prefs_modules_for_all_modules(module_prefs_unstash, (void *)&redissect_flags)
    does two things at the same time:
    - apply the new value for each stashed preference
    - get the redissect_flags bitmap for later treatment
    When the PREF_EFFECT_DISSECTION flag is set, we want to freeze the
    packet list before performing the redissection. This can lead to an
    unexpected state where a given dissector has the preference new value
    applied but the redissection has not been performed yet. If this
    preference has an associated memory allocation for example, it can lead
    to a null pointer dereference.
    To avoid this, iterate two times on the stashed preferences: first to
    get the redissect_flags bitmap, then freeze the packet list if required,
    and finally apply the stashed values.

    Fixes #21380

    (cherry picked from commit c17e8ddddfcdf09a6cfd4818d9595c12532f7d06)

    Conflicts:
            epan/prefs-int.h
            epan/prefs.c
            ui/qt/preferences_dialog.cpp

commit dec594457c7
Author: Pascal Quantin <pascal@wireshark.org>
Date:   Tue Jul 21 00:01:16 2026 +0200

    BT ATT: check handle count when decoding Read Multiple Variable Response

    Fixes #21424

    Thanks to Yazan Balawneh from CyStack Security Team for the report

    (cherry picked from commit 6e2dfd4f0bfc62a35b0d520e57165aee5b441d99)

    Co-authored-by: Pascal Quantin <pascal@wireshark.org>

commit 1df97a20fbd
Author: John Thacker <johnthacker@gmail.com>
Date:   Sun Jul 19 21:50:17 2026 -0500

    reassemble: Put a max limit on add_seq() reassembly lengths

    The add_seq family of reassembly functions uses sequence ids within
    the reassembly (instead of offsets, the way the TCP-like fragment_add
    functions do). The total length is computed at the end. If that length
    overflows, or otherwise goes beyond a maximum supported size
    (INT32_MAX until #20103 is fully solved), stop copying. This prevents
    allocating too short a buffer if the total length would overflow.

    Fix #21423

    Thanks to Daniel Birtwhistle for the report and POC.

    (backported from commit 9f68da57d360629eb7cee8d97d2f894b4858ce8f)

commit 69acc9e74d4
Author: Jaap Keuter <jaap.keuter@xs4all.nl>
Date:   Sun May 17 23:00:27 2026 +0200

    Qt: Introduce a WCA slide

    Compress the banner image while we're here.

    AI-Assisted: no
    (cherry picked from commit b1834d3c8cec3454a879b4b9e7ed7f342cfb3d2c)

commit 71528302b11
Author: Pascal Quantin <pascal@wireshark.org>
Date:   Sun Jul 19 23:12:43 2026 +0200

    C12.22: fix bound check in canonify_unencrypted_header()

    Thanks to Aisle Security for reporting and PoC.

    (cherry picked from commit 94a0319ec2d26b4d724dcafdacf6a7abc2ba2d57)

    Co-authored-by: Pascal Quantin <pascal@wireshark.org>

commit b898938764e
Author: Pascal Quantin <pascal@wireshark.org>
Date:   Sun Jul 19 10:55:55 2026 -0500

    Asterix: only fetch value for field types using it

    Fixes #21266

commit 26edba60656
Author: Pascal Quantin <pascal@wireshark.org>
Date:   Sat Jul 18 13:27:31 2026 -0500

    RDP: fix bound checks

    Fixes #21396

    Thanks to Anthropic's Claude and Ada Logics for reporting and PoC.

    (cherry picked from commit d50d557d84ddb546ca4a43f51034780e2493c409)

     Conflicts:
            epan/tvbuff_rdp.c

commit 64d2949dd8b
Author: Gerald Combs <gerald@wireshark.org>
Date:   Sun Jul 19 10:12:47 2026 +0000

    [Automatic update for 2026-07-19]

    Update manuf, services, enterprise numbers, translations, and other items.

commit 15b969b212f
Author: Gerhard Gappmeier <gerhard.gappmeier@ascolab.com>
Date:   Thu Jul 16 11:35:04 2026 +0200

    opcua: add example capture with abort message

commit 103ce6ac01f
Author: Gerhard Gappmeier <gerhard.gappmeier@ascolab.com>
Date:   Thu Jul 16 10:57:56 2026 +0200

    opcua: Fix parsing of Abort messages

commit ea960718395
Author: John Thacker <johnthacker@gmail.com>
Date:   Sat Jul 18 20:22:46 2026 -0400

    TTL: add some bound checks when parsing segmented messages

    Fixes #21389

    Thanks to Anthropic's Claude and Ada Logics for reporting and PoC.

    (cherry picked from commit f9fdd24295456219f39be01beeaf734c2e3a8a2c)

    Co-authored-by: Pascal Quantin <pascal@wireshark.org>

commit a90ef45d3db
Author: John Thacker <johnthacker@gmail.com>
Date:   Sat Jul 18 10:14:16 2026 -0400

    rlogin: Don't add invalid UTF-8 to a column

    Instead of a fixed array buffer, allocate the string; since we bound
    the length we're willing to read, this shouldn't cause any problems.
    This also means we do sanitization and replacement of invalid characters
    right away.

    Fix #21419

    (cherry picked from commit 7def9acc2c7f9db36662df1cd17b6d73ec91bae9)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit 609ea2b6087
Author: John Thacker <johnthacker@gmail.com>
Date:   Fri Jul 17 21:29:40 2026 -0400

    LBM SRS: Don't throw exceptions in heuristics, again

    Half the changes from 5e17761308a7f6a504727758e75e67b3f370087a
    were undone in a later commit. Heuristic dissectors MUST NOT
    throw exceptions on packets that do not belong to the dissector,
    for example if the packets are too short. All the offsets used
    here are unsigned, which means that subtraction leading to overflow
    results in very big numbers and is not appropriate to use in a
    test. Use overflow-aware API calls like tvb_captured_length_remaining.

    (backported from commit fcc650b39f2dcedd1c6bdb3c7fe8991549690d90)

commit 8d7ea47f44c
Author: John Thacker <johnthacker@gmail.com>
Date:   Thu Jul 16 21:16:41 2026 -0400

    CMake: Update to libgcrypt-1.12.2-3 package

    For some reason the previous package doesn't seem to remember that
    the library is already initialized, and ends up calling LoadLibraryEx
    and FreeLibrary every single time a libgcrypt function is called.

    Fix #21337

    (cherry picked from commit e699ab947839ac6fa5e6d1740dee4502557f5b6e)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit b8a7c24b534
Author: Anders Broman <a.broman58@gmail.com>
Date:   Wed Jul 15 07:26:17 2026 +0200

    erf: Check that a time tag is long enough before copying

    This is a similar test used for other sorts of tags elsewhere
    in the wiretap module for ERF.

    Fix #21415

    Thanks to Jaime Cavero for the report and PoC.

    (cherry picked from commit 4e030d2b1791de6bc84a60278ea730d3660fe6f5)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit 349750c199a
Author: John Thacker <johnthacker@gmail.com>
Date:   Tue Jul 14 00:47:45 2026 -0400

    K12: Fix a possible buffer overrun

    The k12 wiretap module's get_record() has always returned the length
    read in the file, i.e., the offset advanced, not the length of the
    record. These are distinct values because every 8192 bytes there are
    16 byte blobs that are thrown away.

    Starting at least with commit 74322911219429bc6e5a6b17a4bee2fa87e7df65
    19.5 years ago, that return value was incorrectly treated as the record
    length. This meant that the length of extra bytes in the record after
    the frame length was calculated too large whenever the portion of the
    file including the record included the blob.

    Since the buffer is allocated with 8192 bytes originally, this generally
    means copying uninitialized data, but with certain record lengths can
    mean a buffer overrun. The buffer size was increased as necessary to
    accommodate the actual payload, but this did not take into account the
    16 byte blob, and so any value within 16 bytes of 8192 or a power of 2
    multiplied by 8192 could produce this.

    To reduce the confusion, use a Buffer instead of a raw uint8_t array
    with length, and use ws_buffer_length() to retrieve the length written
    to the buffer, as separate from the offset advance.

    Thanks to Jaime Cavero for the report and PoC.

    Fix #21414

    (backported from commit c517aedc993f6f12f6768c9d6115efb0b956e5e3)

commit 0f88a0aa0f5
Author: Pascal Quantin <pascal@wireshark.org>
Date:   Mon Jul 13 16:51:09 2026 +0200

    NAS 5GS: fix dissection of NSAG information

    Fixes #21412

    (cherry picked from commit 8ef8e0fa782cea54570dda01ee25a36b24f03ae7)

    Co-authored-by: Pascal Quantin <pascal@wireshark.org>

commit ab702be7f60
Author: Pascal Quantin <pascal@wireshark.org>
Date:   Mon Jul 13 11:54:14 2026 +0200

    NAS 5GS: fix S-NSSAI location validity information dissection

    Fixes #21411

    (cherry picked from commit c92cf203e28054944c55ad83f28557fa342ed955)

    Co-authored-by: Pascal Quantin <pascal@wireshark.org>

commit d12d3460e84
Author: Gerald Combs <gerald@wireshark.org>
Date:   Tue Oct 14 08:37:38 2025 -0700

    tools: Install Qt 6 by default

    In debain-setup.sh and rpm-setup.sh, just check for the Qt 6 base
    development package and install Qt 6 if it's available.

    (backported from commit 37a5da9777e243eb348417e5ce76eb1593ab13e7)

commit 51d0eea79fb
Author: John Thacker <johnthacker@gmail.com>
Date:   Sun Jul 12 19:23:57 2026 -0400

    sharkd: Make sure to deregister and free taps on failure

    Move registering a single tap to a separate static function,
    and on failure, make sure that all the registered taps are
    removed and freed appropriately.

    Fix #21395

    Thanks to Anthropic's Claude and Ada Logics for reporting and PoC.

    (cherry picked from commit 178939f126d5eeb442d96e10b0ea4c1cfc6920e9)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit c40bdd55da1
Author: John Thacker <johnthacker@gmail.com>
Date:   Sun Jul 12 17:22:15 2026 -0400

    sharkd: Make sure to deregister and already added IO Graphs on error

    Commit 647205177179a6e9ef6c08f08c33a2b405efffbc (pre-3.6.0)
    made it so that bad I/O Graphs lines returned an error immediately
    instead of being silently ignored. This meant that they were no
    longer freed and deregistered.

    Fix #21399

    Thanks to Anthropic's Claude and Ada Logics for reporting.

    (cherry picked from commit d43d89d201b18f1c6d77460e52b4e6b5a4ec68f8)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit 1437cf98993
Author: Gerald Combs <gerald@wireshark.org>
Date:   Sun Jul 12 10:12:28 2026 +0000

    [Automatic update for 2026-07-12]

    Update manuf, services, enterprise numbers, translations, and other items.

commit 4d083e23a1f
Author: John Thacker <johnthacker@gmail.com>
Date:   Sat Jul 11 16:20:55 2026 -0400

    Qt: Append all the system translation paths

    The point of using append in Qt 6.8 and later is to use the
    paths function instead of the path function and get them all.

    Fixup 436c4f357936bbaff6131fe085e0808e6b769808

    (cherry picked from commit 4b62256815aedce57ad2ad539bfda1016b0b2872)

    Co-authored-by: John Thacker <johnthacker@gmail.com>

commit b08a47dfee5
Author: Gerald Combs <gerald@wireshark.org>
Date:   Wed Jul 8 15:18:38 2026 -0700

    Version: 4.6.7 → 4.6.8 [skip ci]
