F-Container: Try to improve error handling.

epan/dissectors/asn1/s1ap/s1ap.cnf

@@ -384,10 +384,23 @@ Port-Number TYPE = FT_UINT16 DISPLAY = BASE_DEC
   struct s1ap_private_data *s1ap_data = s1ap_get_private_data(actx->pinfo);
   s1ap_data->handover_type_value = 0xff;
 
-#.FN_HDR SourceeNB-ToTargeteNB-TransparentContainer
+#.FN_BODY SourceeNB-ToTargeteNB-TransparentContainer
   struct s1ap_private_data *s1ap_data = s1ap_get_private_data(actx->pinfo);
+  volatile guint32 _offset;
 
   s1ap_data->transparent_container_type = SOURCE_TO_TARGET_TRANSPARENT_CONTAINER;
+  _offset = offset;
+   TRY {
+
+  offset = dissect_per_sequence(tvb, _offset, actx, tree, hf_index,
+                                   ett_s1ap_SourceeNB_ToTargeteNB_TransparentContainer, SourceeNB_ToTargeteNB_TransparentContainer_sequence);
+  } CATCH_ALL {
+    show_exception(tvb, actx->pinfo, tree, EXCEPT_CODE, GET_MESSAGE);
+  }
+  ENDTRY;
+    offset = _offset;
+
+
 
 #.FN_BODY Source-ToTarget-TransparentContainer VAL_PTR = &parameter_tvb
 # I think the message is "directly encoded" into the octet string(no "double encoding")
@@ -400,7 +413,7 @@ Port-Number TYPE = FT_UINT16 DISPLAY = BASE_DEC
   tvbuff_t *parameter_tvb;
   proto_tree *subtree;
 
-%(DEFAULT_BODY)s
+  %(DEFAULT_BODY)s
 
   if ((g_s1ap_dissect_container)&&(parameter_tvb) && (tvb_reported_length(parameter_tvb) > 0)) {
     struct s1ap_private_data *s1ap_data = s1ap_get_private_data(actx->pinfo);
@@ -464,10 +477,21 @@ Port-Number TYPE = FT_UINT16 DISPLAY = BASE_DEC
     col_set_writable(actx->pinfo->cinfo, COL_INFO, TRUE);
   }
 
-#.FN_HDR TargeteNB-ToSourceeNB-TransparentContainer
-  struct s1ap_private_data *s1ap_data = s1ap_get_private_data(actx->pinfo);
+#.FN_BODY TargeteNB-ToSourceeNB-TransparentContainer
+    struct s1ap_private_data *s1ap_data = s1ap_get_private_data(actx->pinfo);
+    volatile guint32 _offset;
 
   s1ap_data->transparent_container_type = TARGET_TO_SOURCE_TRANSPARENT_CONTAINER;
+  _offset = offset;
+     TRY {
+
+  _offset = dissect_per_sequence(tvb, _offset, actx, tree, hf_index,
+                                   ett_s1ap_TargeteNB_ToSourceeNB_TransparentContainer, TargeteNB_ToSourceeNB_TransparentContainer_sequence);
+  } CATCH_ALL {
+    show_exception(tvb, actx->pinfo, tree, EXCEPT_CODE, GET_MESSAGE);
+  }
+  ENDTRY;
+    offset = _offset;
 
 #.FN_BODY Target-ToSource-TransparentContainer VAL_PTR = &parameter_tvb
 # I think the message is "directly encoded" into the octet string(no "double encoding")

epan/dissectors/packet-gtpv2.c

@@ -5116,16 +5116,19 @@ dissect_gtpv2_F_container(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, p
     tvbuff_t   *new_tvb;
     proto_tree *sub_tree;
     int         offset = 0;
-    guint8      container_type;
+    guint32      container_type;
     guint8      container_flags, xid_len;
 
     /* Octets   8   7   6   5   4   3   2   1
      * 5            Spare     | Container Type
      */
-    proto_tree_add_item(tree, hf_gtpv2_container_type, tvb, offset, 1, ENC_BIG_ENDIAN);
-    container_type = tvb_get_guint8(tvb, offset);
+    proto_tree_add_item_ret_uint(tree, hf_gtpv2_container_type, tvb, offset, 1, ENC_BIG_ENDIAN, &container_type);
     offset += 1;
     length--;
+    if (length == 0) {
+        proto_tree_add_expert(tree, pinfo, &ei_gtpv2_ie_len_invalid, tvb, offset-3, 3);
+        return;
+    }
     if (   (message_type == GTPV2_FORWARD_RELOCATION_REQ)
         || (message_type == GTPV2_CONTEXT_RESPONSE)
         || (message_type == GTPV2_RAN_INFORMATION_RELAY)) {
@@ -5139,7 +5142,7 @@ dissect_gtpv2_F_container(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, p
              * procedure.
              */
             sub_tree = proto_tree_add_subtree(tree, tvb, offset, length, ett_gtpv2_utran_con, NULL, "UTRAN transparent container");
-            new_tvb = tvb_new_subset_remaining(tvb, offset);
+            new_tvb = tvb_new_subset_length(tvb, offset, length);
             dissect_ranap_Source_ToTarget_TransparentContainer_PDU(new_tvb, pinfo, sub_tree, NULL);
             return;
         case 2:
@@ -5188,7 +5191,7 @@ dissect_gtpv2_F_container(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, p
             * relocation procedure. The Container Type shall be set to 3.
             */
             sub_tree = proto_tree_add_subtree(tree, tvb, offset, length, ett_gtpv2_eutran_con, NULL, "E-UTRAN transparent container");
-            new_tvb = tvb_new_subset_remaining(tvb, offset);
+            new_tvb = tvb_new_subset_length(tvb, offset, length);
             dissect_s1ap_SourceeNB_ToTargeteNB_TransparentContainer_PDU(new_tvb, pinfo, sub_tree, NULL);
             return;
         default:
@@ -5199,7 +5202,7 @@ dissect_gtpv2_F_container(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, p
         switch (container_type) {
         case 3:
             /* E-UTRAN transparent container */
-            new_tvb = tvb_new_subset_remaining(tvb, offset);
+            new_tvb = tvb_new_subset_length(tvb, offset, length);
             dissect_s1ap_ENB_StatusTransfer_TransparentContainer_PDU(new_tvb, pinfo, tree, NULL);
             return;
         default:
@@ -5217,7 +5220,7 @@ dissect_gtpv2_F_container(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, p
              * If the Cause IE contains the value "Request accepted". The Container Type shall be set to 3.
              */
             sub_tree = proto_tree_add_subtree(tree, tvb, offset, length, ett_gtpv2_eutran_con, NULL, "E-UTRAN transparent container");
-            new_tvb = tvb_new_subset_remaining(tvb, offset);
+            new_tvb = tvb_new_subset_length(tvb, offset, length);
             dissect_s1ap_TargeteNB_ToSourceeNB_TransparentContainer_PDU(new_tvb, pinfo, sub_tree, NULL);
             return;
         default: