diff options
| author | Michael Mann <mmann78@netscape.net> | 2016-12-08 21:41:58 -0500 |
|---|---|---|
| committer | Michael Mann <mmann78@netscape.net> | 2016-12-09 18:25:49 +0000 |
| commit | f60ec2581ae825f89e669ca4b4f14917a2aab561 (patch) | |
| tree | fd91cfc7ca1c095372e0da38d6dc3168a99b81b7 /epan | |
| parent | 29841933f934533cc63ff218bf0f6423ee51a7eb (diff) | |
| download | wireshark-f60ec2581ae825f89e669ca4b4f14917a2aab561.tar.gz | |
[ICMP] use abs() in detecting timestamp heuristics
The code was making the assumption that the ICMP data time will always
be greater than or equal to the frame time, but not earlier, but that
is not always the case and the heuristics can fail.
Bug: 13161
Change-Id: I4bc7bd8d22d717d3b1f08afdd651f8a70cb7aef2
Reviewed-on: https://code.wireshark.org/review/19157
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Diffstat (limited to 'epan')
| -rw-r--r-- | epan/dissectors/packet-icmp.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/epan/dissectors/packet-icmp.c b/epan/dissectors/packet-icmp.c index c2ee26491d..ba422196a9 100644 --- a/epan/dissectors/packet-icmp.c +++ b/epan/dissectors/packet-icmp.c @@ -32,6 +32,7 @@ #include "config.h" +#include <stdlib.h> #include <epan/packet.h> #include <epan/prefs.h> @@ -1509,13 +1510,13 @@ dissect_icmp(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, void* data) */ ts.secs = tvb_get_ntohl(tvb, 8); ts.nsecs = tvb_get_ntohl(tvb, 8 + 4); /* Leave at microsec resolution for now */ - if ((guint32) (ts.secs - pinfo->abs_ts.secs) >= + if (abs((int)(ts.secs - pinfo->abs_ts.secs)) >= 3600 * 24 || ts.nsecs >= 1000000) { /* Timestamp does not look right in BE, try LE representation */ ts.secs = tvb_get_letohl(tvb, 8); ts.nsecs = tvb_get_letohl(tvb, 8 + 4); /* Leave at microsec resolution for now */ } - if ((guint32) (ts.secs - pinfo->abs_ts.secs) < + if (abs((int)(ts.secs - pinfo->abs_ts.secs)) < 3600 * 24 && ts.nsecs < 1000000) { ts.nsecs *= 1000; /* Convert to nanosec resolution */ proto_tree_add_time(icmp_tree, hf_icmp_data_time, |