osmocom
/
wireshark
14
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

dfilter: Generalize special case of one byte literal 

Instead of only accepting a byte literal specification if the LHS is a
len-1 byte string, accept it everywhere bytes are wanted.

Before:
  $ dftest "frame[1] contains 0x01"
  Filter: frame[1] contains 0x01

  Constants:
  00000 PUT_FVALUE	01 <FT_BYTES> -> reg#2

  Instructions:
  (...)

  $ dftest "frame[1:4] contains 0x01"
  Filter: frame[1:4] contains 0x01
  dftest: "0x01" is not a valid byte string.

After:
  $ dftest "frame[1:4] contains 0x01"
  $ Filter: frame[1:4] contains 0x01

  Constants:
  00000 PUT_FVALUE	01 <FT_BYTES> -> reg#2

  Instructions:
  (...)
This commit is contained in:
João Valverde 2021-10-06 18:24:40 +01:00 committed by Wireshark GitLab Utility
parent d8b28f8040
commit 5fcdf25697
2 changed files with 10 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
epan/dfilter/semcheck.c
View File

@ -1061,7 +1061,6 @@ check_relation_LHS_RANGE(dfwork_t *dfw, const char *relation_string,
fvalue_t *fvalue;
GRegex *pcre;
char *s;
int len_range;
ws_debug("5 check_relation_LHS_RANGE(%s)", relation_string);
@ -1109,7 +1108,6 @@ check_relation_LHS_RANGE(dfwork_t *dfw, const char *relation_string,
else if (type2 == STTYPE_UNPARSED) {
ws_debug("5 check_relation_LHS_RANGE(type2 = STTYPE_UNPARSED)");
s = (char*)stnode_data(st_arg2);
len_range = drange_get_total_length(sttype_range_drange(st_arg1));
if (strcmp(relation_string, "matches") == 0) {
/* Convert to a GRegex */
pcre = dfilter_g_regex_from_string(dfw, s);
@ -1118,38 +1116,7 @@ check_relation_LHS_RANGE(dfwork_t *dfw, const char *relation_string,
}
stnode_replace(st_arg2, STTYPE_PCRE, pcre);
} else {
/*
* The RHS should be FT_BYTES. However, there is a
* special case where the range slice on the LHS is
* one byte long. In that case, it is natural
* for the user to specify a normal hex integer
* on the RHS, with the "0x" notation, as in
* "slice[0] == 0x10". We can't allow this for any
* slices that are longer than one byte, because
* then we'd have to know which endianness the
* byte string should be in.
*/
if (len_range == 1 && strlen(s) == 4 && strncmp(s, "0x", 2) == 0) {
/*
* Even if the RHS string starts with "0x",
* it still could fail to be an integer.
* Try converting it here.
*/
fvalue = dfilter_fvalue_from_unparsed(dfw, FT_UINT8, s, allow_partial_value);
if (fvalue) {
FVALUE_FREE(fvalue);
/*
* The value doees indeed fit into
* 8 bits. Create a BYTE_STRING
* from it. Since we know that
* the last 2 characters are a valid
* hex string, just use those directly.
*/
fvalue = dfilter_fvalue_from_unparsed(dfw, FT_BYTES, s+2, allow_partial_value);
}
} else {
fvalue = dfilter_fvalue_from_unparsed(dfw, FT_BYTES, s, allow_partial_value);
}
fvalue = dfilter_fvalue_from_unparsed(dfw, FT_BYTES, s, allow_partial_value);
if (!fvalue) {
THROW(TypeError);
}

9
epan/ftypes/ftype-bytes.c
View File

@ -239,6 +239,15 @@ bytes_from_unparsed(fvalue_t *fv, const char *s, gboolean allow_partial_value _U
GByteArray *bytes;
gboolean res;
/*
* Special case where the byte string is specified using a one byte
* hex literal. We can't allow this for byte strings that are longer
* than one byte, because then we'd have to know which endianness the
* byte string should be in.
*/
if (strlen(s) == 4 && s[0] == '0' && s[1] == 'x')
s = s + 2;
bytes = g_byte_array_new();
res = hex_str_to_bytes(s, bytes, TRUE);