From Robert Bullen via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8643

When a TCP segment contains the end of two or more SSL PDUs, the TCP reassembly
code passes that segment up to the SSL dissector multiple times--one for each
SSL PDU. The SSL dissector queues the packet for SSL tap listeners each time it
is invoked. Therefore a single packet can be processed by SSL tap listeners
multiple times. But the tap data that the SSL dissector sends to its tap
listeners is a linked list of all PDUs in the packet.

The SSL tap listener responsible for populating the Follow SSL Stream dialog
did not account for the possibility of seeing a packet multiple times. As a
result, it would process the entire linked list of PDUs each time it received a
packet, and that would result in some SSL PDUs showing up two or more times in
the dialog.

This patch fixes the described bug. It also implements a few slight
improvements in closely related code. See bugzilla for details.


svn path=/trunk/; revision=49387

1 files changed, 1 insertions, 1 deletions

diff --git a/ui/gtk/follow_stream.h b/ui/gtk/follow_stream.h
index 5636438359..beba0d0219 100644
--- a/ui/gtk/follow_stream.h
+++ b/ui/gtk/follow_stream.h
@@ -80,7 +80,7 @@ typedef struct {
 	GtkWidget	*filter_te;
 	GtkWidget	*streamwindow;
         GList           *payload;
-        guint           bytes_written[2];
+        guint           bytes_written[2]; /* Index with FROM_CLIENT or FROM_SERVER for readability. */
         guint           client_port;
         address         client_ip;
 } follow_info_t;