Actually my patch is wrong. The logic is inverted for that one arp function. All the other decoders were actually correct. So this bug only affects the arp decoder. A new patch to fix this is attached. Ignore the last patch completely. Even if it makes eye contact. John. On Thu, 2004-02-12 at 15:59, John Leach wrote: > On Thu, 2004-02-12 at 13:04, Gianni Tedesco wrote: > > > also, my macwatch preprocessor no longer works. Initial poking found > > > that the init function is ok, but the arp callback is never actually > > > executed. > > > > Works for me(tm). Are the ARP packets being decoded OK? > > Yeh, but the dispatch code is messed up. A few other decoders are like > this. Attached patch fixes the ones I spotted (only tested the arp one > though). > > John. -- GPG: B89C D450 5B2C 74D8 58FB A360 9B06 B5C2 26F0 3047 WEB: http://www.johnleach.co.uk
diff -ru firestorm-snapshot/decode_plugins/arp.c firestorm-fixed/decode_plugins/arp.c --- firestorm-snapshot/decode_plugins/arp.c 2004-02-07 20:35:06.000000000 +0000 +++ firestorm-fixed/decode_plugins/arp.c 2004-02-12 16:13:20.329588816 +0000 @@ -48,7 +48,7 @@ { struct layer *l=&p->layer[p->llen]; - if ( l->h.raw+sizeof(struct pkt_arphdr) <= p->end ) { + if ( l->h.raw+sizeof(struct pkt_arphdr) > p->end ) { dispatch(p); return; }
Attachment:
signature.asc
Description: This is a digitally signed message part