nyov/ndpi — pull request #4 by aoshiken (2013-12-12 15:43:59+00:00)
Title: Fixed bug for not treating last byte on ndpi_parse_packet_line_info()

ndpi_parse_packet_line_info() splits a text payload into lines searching for the bytes pair 0x0d0a as the End Of Line marker, unfortunately the loop doesn't take into account the last byte so if your payload ends with 0x0d0a you'll loose the last line.

ndpi_parse_packet_line_info() is used as the macro NDPI_PARSE_PACKET_LINE_INFO from the following files/protocols:
src/lib/protocols/mail_smtp.c
src/lib/protocols/oscar.c
src/lib/protocols/tvuplayer.c

That could be worse than it seems leading to failing heuristics with the mentioned protocols (that was how I noticed it with several SMTP conversations).

You can test it with pcapReader disabling protocol guessing and using only DPI (-d switch).