crash found while fuzzing, and hopefully fixes bug 4867.
In sigcomp_init_udvm() initialize the first 8 bytes of our buffers,
which squelches a valgrind complaint.
svn path=/trunk/; revision=33321
Note that the number of UDVM cycles MUST NOT be increased if a
request for additional compressed data fails.
so we *shouldn't* increase the cycle count further when
SIGCOMP_INSTR_INPUT_BYTES fails. That does *NOT* of course, mean that
we shouldn't increase the cycle count by 1 for a failed INPUT-BYTES
instruction - that would leave UDVM vulnerable to infinite loops (as per
bug 4826), and I *really* doubt that was their intent; presumably, it
means it should not be increased *by the number of cycles for the
additional data*:
Additionally, if the UDVM successfully requests n bits of
compressed data using one of the INPUT instructions then the
number of available UDVM cycles is increased by n *
cycles_per_bit once the instruction has been executed.
if the attempt to get that additional data fails.
svn path=/trunk/; revision=33065
As a workarond for the problem that accsessing a state with a state id > the stored
minimum access length fail, only store and compare the state with the minimum access
lengt specified in the standard of 6 bytes.
svn path=/trunk/; revision=20041
instead of while loops to initialize variables. Use a define instead
of magic numbers. Don't use guint8s for counters. Add a corresponding
entry to the release notes.
svn path=/trunk/; revision=15715
Changes:
o Implemented CRC and SHA-1 (sort operations are still missing)
o After state acccess, the execution start is not necessarily the
beginning of the bytecode; start IP is now a new parameter to
decompress_sigcomp_message()
o Removed some hard-coded assumptions about bytecode starting at offset
128
svn path=/trunk/; revision=15531
-use g_snprintf instead of sprintf and snprintf
-use g_strdup_printf where appropriate
-remove #include "snprintf.h" (as only g_snprintf should be used)
-replace some more alloc/realloc/calloc/free with their glib pendants
svn path=/trunk/; revision=15264
epan/sigcomp_state_hdlr.c epan/sigcomp_state_hdlr.h
---------------------------------------------------
Function udvm_state_access:
1. Removed the state_vars_valid parameter. It is no longer used.
2. The function now correctly updates each of state_length,
state_address and state_instruction with saved state value.
[Previously this was only done for state referenced in the SigComp
message header.]
3. Removed code that (incorrectly) read byte_copy_left from UDVM memory
within the loop that writes the state to UDVM memory.
4. Removed the code that set the useful values in UDVM memory. This
should only be done for state referenced in the SigComp message
header. (The decompress_sigcomp_message function, sets the useful
values.)
epan/sigcomp-udvm.c epan/sigcomp-udvm.h
---------------------------------------
Function decompress_sigcomp_message:
1. Added three new parameters; header_len, byte_code_state_len,
byte_code_id_len. The byte_code_state_len and byte_code_id_len
are used to set the useful values in UDVM memory. The
header_len is required to calculate the cycles available
for decompression.
2. Various minor corrections to spellings, etc in generated
messages.
3. Reduced the number of lines of output for print_level_1. Now
the execution trace shows the instruction name and parameter
values on one line.
[This was done because, we found that even at the lowest
level of detail ethereal became unusably slow; running on
a 500 MHz SPARC. This seems to be related to the number of
lines produced by the SigComp trace, which can easily be over
1000 with the modified code.]
4. Removed the used of some floating point functions. In all
cases they were unnecessary and could potentially cause the
code to produce the wrong results on some platforms (although
this is unlikely).
5. The useful values are now set correctly, using the new
byte_code_state_len and byte_code_id_len parameters.
6. The message header length is now included in the calculation of
maximum_UDVM_cycles. Previously, the calculation could underestimate
the value, resulting in the (small) chance that some legitimate
messages might fail to decompress.
Note: The calculation might now slightly over-estimate the cycles
but this is a reasonable thing to do.
7. Implemented the PUSH, POP, CALL and RETURN instructions.
Note: The two SORT instructions and the CRC and SHA-1 instructions
are still not implemented.
8. The COPY and COPY-LITERAL instructions now apply the
byte-copying-rules to the source address as well as the destination
address.
9. The COPY-LITERAL and COPY-OFFSET now correctly handle the
destination operand. Previously, it was possible for the destination
to be left at byte_copy_right when it should be left at
byte_copy_left.
10. All three COPY instructions will now behave correctly if the source
or destination start at byte_copy_right; i.e. they read/write to
byte_copy_right, byte_copy_right+1, etc. Previously the parameters
would wrap to byte_copy_left.
11. The COPY-OFFSET instruction now correctly calculates the source
address for all values of offset. Previously a very large offset
(greater than the circular buffer size) could cause the starting
position to be mis-calculated.
12. Modulo 65536 arithmetic has been added in some places where it was
missing.
[Only when noticed, we have not been able to check all the code.]
13. Some redundant code was removed for the INPUT-BITS instruction.
Also, INPUT-BITS (0, x, x) now correctly discards spare bits when
the P-bit, has changed.
14. Corrected the cycles used calculation for the INPUT-BITS
instruction.
15. Corrected some minor cases where the used_udvm_cycles was not
incremented.
[Not really a problem, but it allowed us to verify correctness with
some of the SigComp torture tests.]
16. Removed some redundant code in INPUT-HUFFMAN (and reorganised some
comments to keep them making sense).
Function decomp_dispatch_get_bits:
1. This has been rewritten. The original version could not correctly
handle requests for more than 8 bits. The new version is cleaner and
correctly handles all cases.
svn path=/trunk/; revision=14666
Jeff Morriss