search

Open-Markets-Initiative / wireshark-lua

Source generated cross platform Wireshark dissectors
GNU General Public License v3.0
180 stars 64 forks source link

OTCMarkets Multicast "Extended Security Flags" is parsed incorrectly #40

Closed suremarc closed 1 year ago

suremarc commented 1 year ago

Hi,

I work for Polygon.io, a market data vendor. My coworkers and I have been using the plugins here for debugging our own parsers -- it's been extremely helpful.

Recently I was using the OTC Markets Multicast Feeds v4.3 plugin, but I noticed the data was wrong. As it turns out, the parser for the "Extended Security" message type is using the regular "Security Flag" parser, which is 1 byte, but the "Extended Security Flags" type is actually 2 bytes. Furthermore, bit 4 in the regular "Security Flag" parser represents "BBQuoted" while in the Extended version it represents "SponsoredStatus", so it seems one is not a strict superset of the other. Regardless, the size mismatch alone causes the rest of each message to be parsed incorrectly.

The "Extended Security Flag" type is described in the OTC Markets Multicast Feeds v4.3 specification, section 3.3.18, and the regular "Security Flag" type is described in section 3.3.6.

Open-Markets-Initiative commented 1 year ago

Fixed: b28f8659449ef4c17d79396309f38ca63d1cca5e Please try again. Thanks for bringing this to our attention. Also added v4.5.