Ask Your Question

About the enum type of per decode

asked 2018-09-06 11:25:09 +0000

this post is marked as community wiki

This post is a wiki. Anyone with karma >750 is welcome to improve it.

In the function of packet-per.c, dissect_per_enumerated,when there is only one element in the extension part, why not need to decode the element?

the responding code is as follows:

if (ext_num == 1) {
    /* 10.5.4   If "range" has the value 1,
     * then the result of the encoding shall be
     * an empty bit-field (no bits).
    enum_index = 0;

the above regulation cannot be seen in the enum type of per decode regulation

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted

answered 2018-09-07 07:44:55 +0000

Pascal Quantin gravatar image

This is indeed a bug in Wireshark, thanks for reporting it. The fix is available here: and will be backported in all the active branches.

edit flag offensive delete link more

answered 2018-09-06 17:51:40 +0000

Pascal Quantin gravatar image


It comes from the definition of a constrained whole number encoding in ITU X.691 chapter 11.5.4 (Wireshark comment is based on an earlier X.691 specification where the corresponding chapter was 10.5.4).

edit flag offensive delete link more


In the ITU X.691 ,I think the enum type of per decode regulation should be as follows In the presence of an extension marker,if the value is not in the extension root it is encoded as a normally small non-negative whole number , not as a constrained whole number

liwsh880709 gravatar imageliwsh880709 ( 2018-09-07 04:48:57 +0000 )edit

So do you have a pcap triggering this code that we could use to double check the behavior?

Pascal Quantin gravatar imagePascal Quantin ( 2018-09-07 06:13:03 +0000 )edit

Hi, after a second thought I agree with you: this specific case should be removed so as to systematically use the small non-negative whole number encoding. I'm gonna fix it right now, thanks for raising the point.

Pascal Quantin gravatar imagePascal Quantin ( 2018-09-07 07:36:04 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-09-06 11:25:09 +0000

Seen: 433 times

Last updated: Sep 07 '18