Wireshark · Wireshark-dev: Re: [Wireshark-dev] dissect_sip_tcp_heur()

[Pascal Quantin <pascal.quantin@xxxxxxxxx>]

2013/8/10 Martin Kaiser <lists@xxxxxxxxx>

I came across this while browsing through the coverity defects.

gboolean first = TRUE; is never changed

Does the following change make sense to those who are familiar with SIP?

diff --git a/epan/dissectors/packet-sip.c b/epan/dissectors/packet-sip.c
index fa317c8..c04a0c8 100644
--- a/epan/dissectors/packet-sip.c
+++ b/epan/dissectors/packet-sip.c
@@ -2104,6 +2104,7 @@ dissect_sip_tcp_heur(tvbuff_t *tvb, packet_info
*pinfo, proto_tree *tree, void *
                if (len == -1)
                        break;  /* need more data */
                offset += len;
+               first = FALSE;
        }
        return TRUE;
 

Hi Martin,

I'm not really familiar with SIP over TCP (in all my use cases, SIP is over UDP) but your proposal makes sense.

Best regards,
Pascal.