rtmpt: fix dissection of multiple packets on second pass
authorPeter Wu <peter@lekensteyn.nl>
Thu, 3 May 2018 21:15:46 +0000 (23:15 +0200)
committerPeter Wu <peter@lekensteyn.nl>
Sat, 12 May 2018 08:29:14 +0000 (08:29 +0000)
commit16a52bff6cf8ddfec8126bd40c50b65465ede0cd
tree16ebfd49f10c96eed926933bbc8fe55c9c5a5055
parente7cd2f8960b8c2746509d4e2923084db4453bfd7
rtmpt: fix dissection of multiple packets on second pass

The previous fix for the infinite loop in bug 13347 resulted in loop
termination after one round, resulting in ignoring all but the last
packet in a TCP segment.

Observe that the purpose of this loop is to collect all packets where
"tp->seq" refers to the first offset and "tcp->lastseq" refers to the
last position of the packet. If a full packet "tp" is found, then the
previous packet ends at "tp->seq-1" instead of "tp->lastseq-1" (assuming
no overlapping TCP segments).

The infinite loop from bug 13347 occured because of a single packet of
length 1 (tp->seq=0, tp->lastseq=0) and lastseq-1 overflowed. To address
that, terminate the loop once the begin is reached (tp->seq == 0).

Bug: 14650
Change-Id: Ibef382a09c6481b1024dd64dbc8bde904025f057
Fixes: v2.3.0rc0-2153-gee185445f4 ("rtmpt: Ensure sequence count is incremented for stored fragments")
Reviewed-on: https://code.wireshark.org/review/27319
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
epan/dissectors/packet-rtmpt.c