Wireshark · Ethereal-dev: [Ethereal-dev] h.261 dissector bug

[Darran Edmundson <darran.edmundson@xxxxxxxxxx>]

Following up on the other bug report, in file
\ethereal-0.10.6\epan\dissectors\packet-h261.c
I think that:

/* MBAP 2nd octet, 4 bits, 3rd octet 1 bit */
proto_tree_add_uint( h261_tree, hf_h261_mbap, tvb, offset, 1,
	( tvb_get_guint8( tvb, offset ) & 15 )
  	+ ( tvb_get_guint8( tvb, offset + 1 ) >> 7 ) );


should be changed to:

/* MBAP 2nd octet, 4 bits, 3rd octet 1 bit */
proto_tree_add_uint( h261_tree, hf_h261_mbap, tvb, offset, 1,
	( (tvb_get_guint8( tvb, offset ) & 15) << 1 )
  	+ ( tvb_get_guint8( tvb, offset + 1 ) >> 7 ) );

Ie., the 4 bits from the end of the previous byte need to
be shifted 1 position to the left.

Cheers,
Darran.