ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Better dissection in the SMB dissector when captures contain

From: Richard Sharpe <realrichardsharpe@xxxxxxxxx>
Date: Wed, 3 Oct 2012 13:22:53 -0700
On Wed, Oct 3, 2012 at 7:25 AM, Richard Sharpe
<realrichardsharpe@xxxxxxxxx> wrote:
> On Tue, Oct 2, 2012 at 10:43 PM, Jaap Keuter <jaap.keuter@xxxxxxxxx> wrote:
>> Hi,
>>
>> I think this is correct, checking for the availability of data in the TVB is
>> independent of the question if the tree is available or not. That fact should
>> not have influence on the interpretation of the data.

Attached is a first patch that cleans up all the entries that have a
Next Entry Offset and correctly checks that the required number of
bytes is available (checked both with a capture that contained
truncated frames and one that did not.)

-- 
Regards,
Richard Sharpe
(何以解憂?唯有杜康。--曹操)

Attachment: packet-smb-ff2-fixups.patch
Description: Binary data