From Peter Fuller:

If a UDP packet is submitted to the RTP heuristic dissector with either odd src
or dst ports, the heuristic will correctly return FALSE.  However, that
interferes with the next few lines of code that can potentially treat version 0
RTP packets as either STUN or T38 depending on preference settings.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@25150 f5534014-38df-0310-8fa8-9805f1628bb7

diff --git a/epan/dissectors/packet-rtp.c b/epan/dissectors/packet-rtp.c
index e0ca8f24bd47d6bd3bc83193c4d9445762acd034..984f8b258068606a1edc41723d04e38724c43347 100644 (file)
--- a/epan/dissectors/packet-rtp.c
+++ b/epan/dissectors/packet-rtp.c
@@ -478,11 +478,6 @@ dissect_rtp_heur( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree )
        if (! global_rtp_heur)
                return FALSE;
 
-       /* Was it sent between 2 even-numbered ports? */
-       if ((pinfo->srcport % 2) || (pinfo->destport % 2)) {
-               return FALSE;
-       }
-
        /* Get the fields in the first octet */
        octet1 = tvb_get_guint8( tvb, offset );
        version = RTP_VERSION( octet1 );
@@ -507,6 +502,11 @@ dissect_rtp_heur( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree )
                return FALSE;
        }
 
+       /* Was it sent between 2 even-numbered ports? */
+       if ((pinfo->srcport % 2) || (pinfo->destport % 2)) {
+               return FALSE;
+       }
+
        /* Get the fields in the second octet */
        octet2 = tvb_get_guint8( tvb, offset + 1 );
        payload_type = RTP_PAYLOAD_TYPE( octet2 );