Re: packet-rpc.c does not call an rpc sub-dissector when there are no parameters or there is no response

[Richard Sharpe <realrichardsharpe () gmail com>]

On Thu, Jan 12, 2017 at 3:13 PM, Guy Harris <guy () alum mit edu> wrote:
> On Jan 12, 2017, at 3:00 PM, Richard Sharpe <realrichardsharpe () gmail com> wrote:
>
> > In packet-rpc.c we see this:
> >
> >        /*
> >         * Don't call any subdissector if we have no more date to dissect.
> >         */
> >        if (tvb_reported_length_remaining(tvb, offset) == 0) {
> >                return TRUE;
> >        }
> >
> > However, this is wrong, IMO.
> >
> > One of the things that our dissector functions does is insert items
> > like "PROCNAME Reply" etc against the procedure etc, but I would also
> > like to add text like "void" for void parameters etc.
> >
> > Indeed, dissection of the NULL procedure doesn't show much useful ...
> >
> > Does anyone see a problem with changing it to call the sub-dissector
> > even when there is no more data to dissect?
>
> If it reintroduces the "malformed packet" problem mentioned in bug 1392:
>
>         https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1392
>
> then it'd be a problem, as that check was added in
>
>         commit 1984f23e28a19333fa4b3ae7e8e1aba7971fe2ab
>         Author: Sake Blok <sake () euronet nl>
>         Date:   Tue Apr 15 22:53:34 2008 +0000
>
>             Fix for the "Malformed packet: RPC" that is encountered in bug 1392:
>
>             Don't call a RPC subdissector if there is no more data in the packet.

Thanks for that. I agree it would be a problem if that was
reintroduced, so I will test with that capture file ...

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe