osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity

csn1: fix: do not return 0 if no more bits left in the buffer 

The csnStreamDissector() shall not return 0 prematurely if no more
bits left in the input buffer. Otherwise some malformed packets
may not be displayed by Wireshark as such, confusing the user(s).

There are two possible cases:

  a) The number of remaining bits is negative - this is an error
     in any case. Return CSN_ERROR_NEED_MORE_BITS_TO_UNPACK.

  b) The number of remaining bits is zero - this might be an error
     or not depending on particular CSN.1 definition. We don't
     know in advance without entering the parsing loop.

In case a) everything is simple, while in case b) we should not
make precipitate decicions. Some CSN.1 definitions have names
like 'M_*_OR_NULL', what basically means that they're optional
and can be ignored or omitted.

Most of the case statements do check whether the number of remaining
bits is enough to unpack a value, so let's leave the final decicion
up to the current handler (pointed by pDescr) if no more bits left.

This is a port of the original patch [1] for OsmoPCU [2].

[1] https://gerrit.osmocom.org/c/osmo-pcu/+/17394
[2] https://osmocom.org/projects/osmopcu/

Change-Id: If35d62b1cb81e8b2909401684c3b801cb79f1294
Reviewed-on: https://code.wireshark.org/review/36588
Reviewed-by: Pau Espin Pedrol <pespin@sysmocom.de>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot
Reviewed-by: Gerald Combs <gerald@wireshark.org>
This commit is contained in:
Vadim Yanitskiy 2020-03-27 02:25:16 +07:00 committed by Gerald Combs
parent ac78d8658d
commit 9f1b91a4a0
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
epan/dissectors/packet-csn1.c
View File

@ -160,9 +160,10 @@ csnStreamDissector(proto_tree *tree, csnStream_t* ar, const CSN_DESCR* pDescr, t
guint32* pui32;
guint8 Tag = STANDARD_TAG;
if (remaining_bits_len <= 0)
/* Negative number definitely indicates an error */
if (remaining_bits_len < 0)
{
return 0;
return ProcessError(tree, ar->pinfo, tvb, bit_offset, CSN_ERROR_NEED_MORE_BITS_TO_UNPACK, &ei_csn1_more_bits_to_unpack, pDescr);
}
do