Wireshark · Ethereal-dev: [Ethereal-dev] h.261 dissector bug

[Darran Edmundson <darran.edmundson@xxxxxxxxxx>]

I'm seeing an apparent problem with the h261 packet
dissector in that a supposed 3-bit value can show
up as a value requiring more than 3 bits.

For example, say the byte value is 0x3e (00111110).
In this case, ethereal gives an EBIT of 15.  I suggest
that in the code below, use of the left shift to clear the
3 MSBs followed by a shift down to the LSB should be
replaced with a single right shift and a mask.


\ethereal-0.10.6\epan\dissectors\packet-h261.c

/* EBIT 1st octet, 3 bits */
proto_tree_add_uint( h261_tree, hf_h261_ebit, tvb, offset, 1, ( 
tvb_get_guint8( tvb, offset )  << 3 ) >> 5 );


Cheers,
Darran.