Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] Decoding of GSM (G)MM-INFORMATION containing DST IE no longer wo

From: Reinhard Speyerer <rspmn@xxxxxxxx>
Date: Tue, 17 Mar 2009 22:30:09 +0100
As can be seen from the attached .pcap file (Decode User 0 (DLT=147) as gsm_a_dtap)
decoding of GSM (G)MM-INFORMATION messages containing a Daylight Saving Time IE
which works in Wireshark 1.0.6 no longer works in SVN rev 27719.

This seems to be caused by the introduction of the two octet length support for
GSM_BSSMAP_APDU_IE in SVN revision 24881 of packet-gsm_a_common.c as the same
IEI 0x49 is also used for the Daylight Saving Time IE.

The attached patch restores the ability to decode these messages at the expense
of not being able to decode GSM_BSSMAP_APDU_IE with length between 256 and 511
(which are not currently supported by Wireshark).

Are there better ways to restore the decoding of SM (G)MM-INFORMATION messages
containing a Daylight Saving Time IE?

Regards,
Reinhard

Attachment: mm-info-wireshark.pcap
Description: Binary data

--- packet-gsm_a_common.c.~1~	Sat Mar  7 16:20:57 2009
+++ packet-gsm_a_common.c	Mon Mar 16 12:40:35 2009
@@ -666,7 +666,7 @@
 	oct = tvb_get_guint8(tvb, curr_offset);
 
 	if (oct == iei){
-		if (oct == GSM_BSSMAP_APDU_IE){
+		if (oct == GSM_BSSMAP_APDU_IE && tvb_get_guint8(tvb, curr_offset + 1) != 1){
 			/* This elements length is in two octets (a bit of a hack here)*/
 			lengt_length = 2;
 			parm_len = tvb_get_ntohs(tvb, curr_offset + 1);