osmocom
/
wireshark
11
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

Add recursion checks to CSN.1, GSM A-bis OML, NAS-5GS, SolarEdge, and WMIO

This commit is contained in:
Gerald Combs 2024-03-16 10:35:37 -07:00
parent 68f427822a
commit 73b6bf25e2
5 changed files with 44 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
epan/dissectors/packet-csn1.c
View File

@ -150,6 +150,7 @@ existNextElement(tvbuff_t *tvb, gint bit_offset, guint8 Tag)
gint16
// NOLINTNEXTLINE(misc-no-recursion)
csnStreamDissector(proto_tree *tree, csnStream_t* ar, const CSN_DESCR* pDescr, tvbuff_t *tvb, void* data, int ett_csn1)
{
gint remaining_bits_len = ar->remaining_bits_len;
@ -475,7 +476,9 @@ csnStreamDissector(proto_tree *tree, csnStream_t* ar, const CSN_DESCR* pDescr, t
test_tree = proto_tree_add_subtree_format(tree, tvb, bit_offset>>3, 1, ett_csn1, &ti, "%s[%d]",pDescr->sz, i++);
csnStreamInit(&arT, bit_offset, remaining_bits_len, ar->pinfo);
increment_dissection_depth(ar->pinfo);
Status = csnStreamDissector(test_tree, &arT, (const CSN_DESCR*)pDescr->descr.ptr, tvb, pui8, ett_csn1);
decrement_dissection_depth(ar->pinfo);
if (Status >= 0)
{
pui8 += nSize;
@ -539,7 +542,9 @@ csnStreamDissector(proto_tree *tree, csnStream_t* ar, const CSN_DESCR* pDescr, t
} else {
test_tree = proto_tree_add_subtree_format(tree, tvb, bit_offset>>3, 1, ett_csn1, &ti, "%s", pDescr->sz);
csnStreamInit(&arT, bit_offset, remaining_bits_len, ar->pinfo);
increment_dissection_depth(ar->pinfo);
Status = csnStreamDissector(test_tree, &arT, (const CSN_DESCR*)pDescr->descr.ptr, tvb, pvDATA(data, pDescr->offset), ett_csn1);
decrement_dissection_depth(ar->pinfo);
if (Status >= 0)
{
proto_item_set_len(ti,((arT.bit_offset-1)>>3) - (bit_offset>>3)+1);
@ -604,7 +609,9 @@ csnStreamDissector(proto_tree *tree, csnStream_t* ar, const CSN_DESCR* pDescr, t
}
csnStreamInit(&arT, bit_offset, remaining_bits_len, ar->pinfo);
increment_dissection_depth(ar->pinfo);
Status = csnStreamDissector(test_tree, &arT, (const CSN_DESCR*)descr, tvb, data, ett_csn1);
decrement_dissection_depth(ar->pinfo);
if (Status >= 0)
{
@ -960,7 +967,9 @@ csnStreamDissector(proto_tree *tree, csnStream_t* ar, const CSN_DESCR* pDescr, t
test_tree = proto_tree_add_subtree_format(tree, tvb, bit_offset>>3, 1, ett_csn1, &ti, "%s[%d]",pDescr->sz, i++);
csnStreamInit(&arT, bit_offset, remaining_bits_len, ar->pinfo);
increment_dissection_depth(ar->pinfo);
Status = csnStreamDissector(test_tree, &arT, (const CSN_DESCR *)pDescr->descr.ptr, tvb, pui8, ett_csn1);
decrement_dissection_depth(ar->pinfo);
if (Status >= 0)
{
pui8 += nSize;
@ -1013,7 +1022,9 @@ csnStreamDissector(proto_tree *tree, csnStream_t* ar, const CSN_DESCR* pDescr, t
} else {
test_tree = proto_tree_add_subtree(tree, tvb, bit_offset>>3, 1, ett_csn1, &ti, pDescr->sz);
csnStreamInit(&arT, bit_offset, remaining_bits_len, ar->pinfo);
increment_dissection_depth(ar->pinfo);
Status = csnStreamDissector(test_tree, &arT, (const CSN_DESCR *)pDescr->descr.ptr, tvb, pvDATA(data, pDescr->offset), ett_csn1);
decrement_dissection_depth(ar->pinfo);
if (Status >= 0)
{
proto_item_set_len(ti,((arT.bit_offset-1)>>3) - (bit_offset>>3)+1);
@ -1405,7 +1416,9 @@ csnStreamDissector(proto_tree *tree, csnStream_t* ar, const CSN_DESCR* pDescr, t
test_tree = proto_tree_add_subtree(tree, tvb, bit_offset>>3, 1, ett_csn1, &ti, pDescr->sz);
csnStreamInit(&arT, bit_offset, remaining_bits_len, ar->pinfo);
increment_dissection_depth(ar->pinfo);
Status = csnStreamDissector(test_tree, &arT, (const CSN_DESCR *)pDescr->descr.ptr, tvb, pvDATA(data, pDescr->offset), ett_csn1);
decrement_dissection_depth(ar->pinfo);
if (Status >= 0)
{ /* successful completion */
@ -1474,7 +1487,9 @@ csnStreamDissector(proto_tree *tree, csnStream_t* ar, const CSN_DESCR* pDescr, t
test_tree = proto_tree_add_subtree_format(tree, tvb, bit_offset>>3, 1, ett_csn1, &ti, "%s[%d]", pDescr->sz, ElementCount-1);
csnStreamInit(&arT, bit_offset, remaining_bits_len, ar->pinfo);
increment_dissection_depth(ar->pinfo);
Status = csnStreamDissector(test_tree, &arT, (const CSN_DESCR *)pDescr->descr.ptr, tvb, pvDATA(data, pDescr->offset), ett_csn1);
decrement_dissection_depth(ar->pinfo);
if (Status >= 0)
{ /* successful completion */

6
epan/dissectors/packet-gsm_abis_oml.c
View File

@ -1567,6 +1567,7 @@ dissect_ipacc_test_rep(proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb)
/* Dissect OML FOM Attributes after OML + FOM header */
static gint
// NOLINTNEXTLINE(misc-no-recursion)
dissect_oml_attrs(tvbuff_t *tvb, int base_offs, int length,
packet_info *pinfo, proto_tree *tree)
{
@ -1770,7 +1771,9 @@ dissect_oml_attrs(tvbuff_t *tvb, int base_offs, int length,
tvb, loffset++, 1,
ENC_LITTLE_ENDIAN);
}
increment_dissection_depth(pinfo);
dissect_oml_attrs(tvb, loffset, len - 1 - not_counted, pinfo, att_tree);
decrement_dissection_depth(pinfo);
}
break;
case NM_ATT_INTERF_BOUND:
@ -2804,8 +2807,7 @@ proto_register_abis_oml(void)
NM_ATT_TLVDEF_IPA(NM_ATT_IPACC_CGI, TLV_TYPE_TL16V, 0);
/* assign our custom match functions */
proto_abis_oml = proto_register_protocol("GSM A-bis OML", "A-bis OML",
"gsm_abis_oml");
proto_abis_oml = proto_register_protocol("GSM A-bis OML", "A-bis OML", "gsm_abis_oml");
proto_register_field_array(proto_abis_oml, hf, array_length(hf));

3
epan/dissectors/packet-nas_5gs.c
View File

@ -2919,12 +2919,14 @@ static const value_string nas_5gs_mm_pld_cont_opt_ie_type_vals[] = {
* 9.11.3.39 Payload container
*/
static guint16
// NOLINTNEXTLINE(misc-no-recursion)
de_nas_5gs_mm_pld_cont(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo,
guint32 offset, guint len,
gchar *add_string _U_, int string_len _U_)
{
struct nas5gs_private_data *nas5gs_data = nas5gs_get_private_data(pinfo);
increment_dissection_depth(pinfo);
switch (nas5gs_data->payload_container_type) {
case 1: /* N1 SM information */
dissect_nas_5gs_common(tvb_new_subset_length(tvb, offset, len), pinfo, tree, 0, NULL);
@ -3054,6 +3056,7 @@ de_nas_5gs_mm_pld_cont(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo,
proto_tree_add_item(tree, hf_nas_5gs_mm_pld_cont, tvb, offset, len, ENC_NA);
break;
}
decrement_dissection_depth(pinfo);
return len;
}

12
epan/dissectors/packet-solaredge.c
View File

@ -1029,6 +1029,7 @@ void solaredge_decrypt(const guint8 *in, gint length, guint8 *out, gcry_cipher_h
}
static int
// NOLINTNEXTLINE(misc-no-recursion)
dissect_solaredge_devicedata(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gint offset, gint length)
{
gint current_offset;
@ -1054,6 +1055,7 @@ dissect_solaredge_devicedata(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree
current_offset = offset + SOLAREDGE_POST_HEADER_LENGTH;
col_append_str(pinfo->cinfo, COL_INFO, " ");
increment_dissection_depth(pinfo);
switch(device_header.type) {
case SOLAREDGE_DEVICETYPE_OPTIMIZER:
col_append_str(pinfo->cinfo, COL_INFO, "Optimizer");
@ -1218,6 +1220,7 @@ dissect_solaredge_devicedata(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree
current_offset += device_header.device_length;
break;
}
decrement_dissection_depth(pinfo);
if (current_offset < length) {
col_append_str(pinfo->cinfo, COL_INFO, ", ");
@ -1227,6 +1230,7 @@ dissect_solaredge_devicedata(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree
}
static int
// NOLINTNEXTLINE(misc-no-recursion)
dissect_solaredge_recursive(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree _U_, void *data _U_, gint ett, conversation_t *conv)
{
proto_item *ti;
@ -1276,6 +1280,7 @@ dissect_solaredge_recursive(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree
current_offset += 2;
col_append_str(pinfo->cinfo, COL_INFO, val_to_str_const(header.command_type, solaredge_packet_commandtypes, "Unknown command"));
increment_dissection_depth(pinfo);
switch (header.command_type) {
case SOLAREDGE_COMMAND_MISC_ENCRYPTED:
proto_tree_add_item(solaredge_header_tree, hf_solaredge_payload_type, tvb, current_offset, header.length, ENC_NA);
@ -1335,6 +1340,7 @@ dissect_solaredge_recursive(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree
current_offset += header.length;
break;
}
decrement_dissection_depth(pinfo);
/* Validate CRC */
proto_tree_add_checksum(solaredge_header_tree, tvb, SOLAREDGE_HEADER_LENGTH + header.length, hf_solaredge_crc_type, hf_solaredge_crc_status_type, &ei_solaredge_invalid_crc, pinfo, calculate_crc(&header, tvb_get_ptr(tvb, SOLAREDGE_HEADER_LENGTH, header.length), header.length), ENC_LITTLE_ENDIAN, PROTO_CHECKSUM_VERIFY);
@ -1653,11 +1659,7 @@ proto_register_solaredge(void)
&ett_solaredge_packet_post_device
};
proto_solaredge = proto_register_protocol (
"SolarEdge monitoring protocol",
"SolarEdge",
"solaredge"
);
proto_solaredge = proto_register_protocol ("SolarEdge monitoring protocol", "SolarEdge", "solaredge");
solaredge_handle = register_dissector("solaredge", dissect_solaredge, proto_solaredge);
module_t * module_solaredge = prefs_register_protocol(proto_solaredge, NULL);

15
epan/dissectors/packet-wmio.c
View File

@ -528,6 +528,7 @@ dissect_wmio_encoded_string(tvbuff_t *tvb, gint offset, int hfindex, packet_info
* ObjectBlock = ObjectFlags [Decoration] Encoding
*/
static int
// NOLINTNEXTLINE(misc-no-recursion)
dissect_wmio_objectblock(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree)
{
gint8 flags = tvb_get_guint8(tvb, offset);
@ -536,6 +537,8 @@ dissect_wmio_objectblock(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_t
ett_wmio_object_flags, wmio_object_flags, ENC_NA);
offset+=1;
increment_dissection_depth(pinfo);
if (WMIO_OBJECT_FLAG_HAS_DECORATION & flags){
offset = dissect_wmio_object_decoration(tvb, offset, pinfo, tree);
}
@ -544,6 +547,8 @@ dissect_wmio_objectblock(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_t
offset = dissect_wmio_encoding_classtype(tvb, offset, pinfo, tree);
}
decrement_dissection_depth(pinfo);
return offset;
}
@ -570,14 +575,19 @@ dissect_wmio_object_decoration(tvbuff_t *tvb, gint offset, packet_info *pinfo, p
}
static int
// NOLINTNEXTLINE(misc-no-recursion)
dissect_wmio_encoding_classtype(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *tree)
{
increment_dissection_depth(pinfo);
// ParentClass
offset = dissect_wmio_encoding_classandmethodspart(tvb, offset, pinfo, tree, hf_parentclass, ett_parentclass, true);
// CurrentClass
offset = dissect_wmio_encoding_classandmethodspart(tvb, offset, pinfo, tree, hf_currentclass, ett_currentclass, true);
decrement_dissection_depth(pinfo);
return offset;
}
@ -586,6 +596,7 @@ dissect_wmio_encoding_classtype(tvbuff_t *tvb, gint offset, packet_info *pinfo,
* ClassAndMethodsPart = ClassPart [MethodsPart]
*/
static int
// NOLINTNEXTLINE(misc-no-recursion)
dissect_wmio_encoding_classandmethodspart(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *parent_tree, int hf_index, gint ett_id, bool methods)
{
proto_item *item = NULL;
@ -1064,6 +1075,7 @@ dissect_wmio_encoding_derivationlist(tvbuff_t *tvb, gint offset, packet_info *pi
* MethodSignature = HeapMethodSignatureBlockRef
*/
static void
// NOLINTNEXTLINE(misc-no-recursion)
dissect_wmio_encoding_methodsignature(tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *parent_tree, int hfindex, gint methodsheapoffset)
{
@ -1095,6 +1107,7 @@ dissect_wmio_encoding_methodsignature(tvbuff_t *tvb, gint offset, packet_info *p
* MethodDescription = MethodName MethodFlags MethodPadding MethodOrigin MethodQualifiers InputSignature OutputSignature
*/
static int
// NOLINTNEXTLINE(misc-no-recursion)
dissect_wmio_encoding_methodpart_methoddescription(tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *parent_tree, gint methodsheapoffset)
{
@ -1132,6 +1145,7 @@ dissect_wmio_encoding_methodpart_methoddescription(tvbuff_t *tvb, gint offset, p
}
static int
// NOLINTNEXTLINE(misc-no-recursion)
dissect_wmio_encoding_methodpart_methods(tvbuff_t *tvb, gint offset, packet_info *pinfo,
proto_tree *parent_tree, guint32 methodscount, gint methodsheapoffset)
{
@ -1155,6 +1169,7 @@ dissect_wmio_encoding_methodpart_methods(tvbuff_t *tvb, gint offset, packet_info
* MethodsPart = EncodingLength MethodCount MethodCountPadding *MethodDescription MethodHeap
*/
static int
// NOLINTNEXTLINE(misc-no-recursion)
dissect_wmio_encoding_methodpart(tvbuff_t *tvb, gint offset, packet_info *pinfo, proto_tree *parent_tree)
{
proto_item *item = NULL;