 | 1 | initial version |
To quote RFC 2046, section 5.1.1 "Common Syntax" (that's "syntax" of the multipart media type, which is what section 5.1 in general deals with):
The boundary delimiter MUST occur at the beginning of a line, i.e., following a CRLF, and the initial CRLF is considered to be attached to the boundary delimiter line rather than part of the preceding part. The boundary may be followed by zero or more characters of linear whitespace. It is then terminated by either another CRLF and the header fields for the next part, or by two CRLFs, in which case there are no header fields for the next part. If no Content-Type field is present it is assumed to be "message/rfc822" in a "multipart/digest" and "text/plain" otherwise.
So:
---boundaryRMS123
Content-Type: application/json
etc. would appear to be a part with no header files, so that the first line of the body is "Content-Type: application/json".
So whatever generated that packet is not generating valid multipart/form-data information - it needs to put the Content-Type: line immediately after the boundary. 1.12.4 is incorrectly dissecting the incorrect data; newer versions are dissecting it correctly.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.