MS-WSP: CPMConnectIn request appears to be corrupt

[liranoz12]

MS-WSP: CPMConnectIn request appears to be corrupt

[Dingshouqing]

Hi Liran,
Thanks for reporting this issue.

From your capture, it looks like it’s a Wireshark parser bug, according to our document [MS-WSP]: CBaseStorageVariant | Microsoft Docs VT_LPWSTR is a structure and it has two elements cLen and string as below:

But it seems Wireshark parses this structure as a null-terminated string, which causes parsing to fail.
The right binary data of vValue should be: 01 00 00 00 00 00 00 00, cLen is 0, as value is 0x00000000 so there is no string element.

“a5 ac af xxx” belongs to the next PropertySet.

Best Regards,
Windows Protocol Test Suites Development Team

[liranoz12]

Great, thanks for the help!