Fix more bugs reported by Ilja van Sprundel.

packet-pktc.c:
  Catch an underflow.

packet-ospf.c:
  Don't burn CPU cycles unnecessarily.

packet-rpc.c:
  Catch an overflow.

packet-mq.c:
  Check a header size.

Fix up whitespace.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@18685 f5534014-38df-0310-8fa8-9805f1628bb7

diff --git a/epan/dissectors/packet-mq.c b/epan/dissectors/packet-mq.c
index 87f996e93765a83c8e290e1751256cb57fc0c603..9529b4917cfc3a3525f880b8d5785c4bd803971c 100644 (file)
--- a/epan/dissectors/packet-mq.c
+++ b/epan/dissectors/packet-mq.c
@@ -2204,7 +2204,10 @@ dissect_mq_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
                                                                        /* Dissect the generic part of the other pre-defined headers */
                                                                        /* We assume that only one such header is present */
                                                                        gint iSizeHeader = 0;
-                                                                       iSizeHeader = tvb_get_guint32_endian(tvb, offset + 8, bLittleEndian);
+                                                                       iSizeHeader = (gint) tvb_get_guint32_endian(tvb, offset + 8, bLittleEndian);
+                  /* XXX - 32 is inferred from the code below.  What's the
+                   * correct minimum? */
+                  DISSECTOR_ASSERT(iSizeHeader > 32);
 
                                                                        if (tvb_length_remaining(tvb, offset) >= iSizeHeader)
                                                                        {

diff --git a/epan/dissectors/packet-ospf.c b/epan/dissectors/packet-ospf.c
index f11bff263e4d5e29bb274e7c5066bc42546fe062..fdf087daefa851d500656d3b18e1fd058139d3ce 100644 (file)
--- a/epan/dissectors/packet-ospf.c
+++ b/epan/dissectors/packet-ospf.c
@@ -9,7 +9,7 @@
  *       draft-nguyen-ospf-oob-resync-05.txt
  *       draft-nguyen-ospf-restart-05.txt
  *   - (c) 2005 Michael Rozhavsky <mrozhavsky@fortinet.com>
- * 
+ *
  * At this time, this module is able to analyze OSPF
  * packets as specified in RFC2328. MOSPF (RFC1584) and other
  * OSPF Extensions which introduce new Packet types
@@ -892,7 +892,7 @@ static int dissect_ospf_v3_lsa(tvbuff_t*, int, proto_tree*, gboolean disassemble
 
 static void dissect_ospf_v3_address_prefix(tvbuff_t *, int, int, proto_tree *);
 
-static int 
+static int
 ospf_has_lls_block(tvbuff_t *tvb, int offset, guint8 packet_type)
 {
     guint8 flags;
@@ -1136,27 +1136,27 @@ dissect_ospf(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
        switch (packet_type){
 
        case OSPF_HELLO:
-           dissect_ospf_hello(tvb, ospf_header_length, ospf_tree, version, 
+           dissect_ospf_hello(tvb, ospf_header_length, ospf_tree, version,
                            ospflen - ospf_header_length);
            break;
 
        case OSPF_DB_DESC:
-           dissect_ospf_db_desc(tvb, ospf_header_length, ospf_tree, version, 
+           dissect_ospf_db_desc(tvb, ospf_header_length, ospf_tree, version,
                            ospflen - ospf_header_length);
            break;
 
        case OSPF_LS_REQ:
-           dissect_ospf_ls_req(tvb, ospf_header_length, ospf_tree, version, 
+           dissect_ospf_ls_req(tvb, ospf_header_length, ospf_tree, version,
                            ospflen - ospf_header_length);
            break;
 
        case OSPF_LS_UPD:
-           dissect_ospf_ls_upd(tvb, ospf_header_length, ospf_tree, version, 
+           dissect_ospf_ls_upd(tvb, ospf_header_length, ospf_tree, version,
                            ospflen - ospf_header_length);
            break;
 
        case OSPF_LS_ACK:
-           dissect_ospf_ls_ack(tvb, ospf_header_length, ospf_tree, version, 
+           dissect_ospf_ls_ack(tvb, ospf_header_length, ospf_tree, version,
                            ospflen - ospf_header_length);
            break;
 
@@ -1168,7 +1168,7 @@ dissect_ospf(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 
        /* take care of the LLS data block */
        if (ospf_has_lls_block(tvb, ospf_header_length, packet_type))
-           dissect_ospf_lls_data_block(tvb, ospflen + crypto_len, ospf_tree, 
+           dissect_ospf_lls_data_block(tvb, ospflen + crypto_len, ospf_tree,
                            version);
     }
 }
@@ -1184,25 +1184,25 @@ dissect_ospf_lls_tlv(tvbuff_t *tvb, int offset, proto_tree *tree)
     type = tvb_get_ntohs(tvb, offset);
     length = tvb_get_ntohs(tvb, offset + 2);
 
-    ti = proto_tree_add_text(tree, tvb, offset, length + 4, 
+    ti = proto_tree_add_text(tree, tvb, offset, length + 4,
                    val_to_str(type, lls_tlv_type_vals, "Unknown TLV"));
     ospf_lls_tlv_tree = proto_item_add_subtree(ti, ett_ospf_lls_tlv);
-    
+
     proto_tree_add_text(ospf_lls_tlv_tree, tvb, offset, 2,
                    "Type: %d", type);
     proto_tree_add_text(ospf_lls_tlv_tree, tvb, offset + 2, 2,
                    "Length: %d", length);
-      
+
     switch(type) {
        case 1:
            dissect_ospf_bitfield(ospf_lls_tlv_tree, tvb, offset + 4, &bfinfo_lls_ext_options);
            break;
        case 2:
-           proto_tree_add_text(ospf_lls_tlv_tree, tvb, offset + 4, 4, 
-                           "Sequence number 0x%08x", 
+           proto_tree_add_text(ospf_lls_tlv_tree, tvb, offset + 4, 4,
+                           "Sequence number 0x%08x",
                            tvb_get_ntohl(tvb, offset + 4));
            proto_tree_add_text(ospf_lls_tlv_tree, tvb, offset + 8, length - 4,
-                           "Auth Data: %s", 
+                           "Auth Data: %s",
                            tvb_bytes_to_str(tvb, offset + 8, length - 4));
            break;
     }
@@ -1211,7 +1211,7 @@ dissect_ospf_lls_tlv(tvbuff_t *tvb, int offset, proto_tree *tree)
 }
 
 static void
-dissect_ospf_lls_data_block(tvbuff_t *tvb, int offset, proto_tree *tree, 
+dissect_ospf_lls_data_block(tvbuff_t *tvb, int offset, proto_tree *tree,
                guint8 version)
 {
     proto_tree *ospf_lls_data_block_tree;
@@ -1221,25 +1221,25 @@ dissect_ospf_lls_data_block(tvbuff_t *tvb, int offset, proto_tree *tree,
 
     ospf_lls_len = tvb_get_ntohs(tvb, offset + 2);
     ti = proto_tree_add_text(tree, tvb, offset, -1, "OSPF LLS Data Block");
-    ospf_lls_data_block_tree = proto_item_add_subtree(ti, 
+    ospf_lls_data_block_tree = proto_item_add_subtree(ti,
                    ett_ospf_lls_data_block);
 
     if (version != OSPF_VERSION_2)
            return;
 
     /* TODO: verify checksum */
-    proto_tree_add_text(ospf_lls_data_block_tree, tvb, offset, 2, 
+    proto_tree_add_text(ospf_lls_data_block_tree, tvb, offset, 2,
                    "Checksum: 0x%04x", tvb_get_ntohs(tvb, offset));
     proto_tree_add_text(ospf_lls_data_block_tree, tvb, offset + 2, 2,
                    "LLS Data Length: %d bytes", ospf_lls_len * 4);
-    
+
     offset += 4;
     while (orig_offset + ospf_lls_len * 4 > offset)
        offset = dissect_ospf_lls_tlv (tvb, offset, ospf_lls_data_block_tree);
 }
 
 static void
-dissect_ospf_hello(tvbuff_t *tvb, int offset, proto_tree *tree, guint8 version, 
+dissect_ospf_hello(tvbuff_t *tvb, int offset, proto_tree *tree, guint8 version,
                guint16 length)
 {
     proto_tree *ospf_hello_tree;
@@ -1303,7 +1303,7 @@ dissect_ospf_hello(tvbuff_t *tvb, int offset, proto_tree *tree, guint8 version,
 }
 
 static void
-dissect_ospf_db_desc(tvbuff_t *tvb, int offset, proto_tree *tree, 
+dissect_ospf_db_desc(tvbuff_t *tvb, int offset, proto_tree *tree,
                guint8 version, guint16 length)
 {
     proto_tree *ospf_db_desc_tree=NULL;
@@ -1434,9 +1434,12 @@ dissect_ospf_ls_upd(tvbuff_t *tvb, int offset, proto_tree *tree, guint8 version,
     while (lsa_counter < lsa_nr) {
         if ( version == OSPF_VERSION_2)
            offset = dissect_ospf_v2_lsa(tvb, offset, ospf_lsa_upd_tree, TRUE);
-        else
-            if ( version == OSPF_VERSION_3)
+        else if ( version == OSPF_VERSION_3)
                offset = dissect_ospf_v3_lsa(tvb, offset, ospf_lsa_upd_tree, TRUE);
+        else
+            /* We could potentially waste CPU cycles looping */
+            lsa_counter = lsa_nr;
+
         lsa_counter += 1;
     }
 }
@@ -1595,7 +1598,7 @@ dissect_ospf_lsa_mpls(tvbuff_t *tvb, int offset, proto_tree *tree,
                    ti = proto_tree_add_text(tlv_tree, tvb, stlv_offset, stlv_len+4,
                                     "%s: %u - %s", stlv_name,
                                     tvb_get_guint8(tvb, stlv_offset + 4),
-                                    val_to_str(tvb_get_guint8(tvb, stlv_offset + 4), 
+                                    val_to_str(tvb_get_guint8(tvb, stlv_offset + 4),
                                        mpls_link_stlv_ltype_str, "Unknown Link Type"));
                    stlv_tree = proto_item_add_subtree(ti, ett_ospf_lsa_mpls_link_stlv);
                    proto_tree_add_text(stlv_tree, tvb, stlv_offset, 2,
@@ -1716,11 +1719,11 @@ dissect_ospf_lsa_mpls(tvbuff_t *tvb, int offset, proto_tree *tree,
                                              tvb_get_ntohl(tvb, stlv_offset + 8),
                                              tvb_get_ntohl(tvb, stlv_offset + 8));
                    stlv_tree = proto_item_add_subtree(ti, ett_ospf_lsa_mpls_link_stlv);
-                   
+
                    proto_tree_add_text(stlv_tree, tvb, stlv_offset, 2,
                                        "TLV Type: %u: %s", stlv_type, stlv_name);
                    proto_tree_add_text(stlv_tree, tvb, stlv_offset+2, 2, "TLV Length: %u",
-                                       stlv_len);                      
+                                       stlv_len);
                     proto_tree_add_item(stlv_tree,
                                         ospf_filter[OSPFF_LS_MPLS_LOCAL_IFID],
                                         tvb, stlv_offset+4, 4, FALSE);
@@ -1781,7 +1784,7 @@ dissect_ospf_lsa_mpls(tvbuff_t *tvb, int offset, proto_tree *tree,
                    proto_tree_add_text(stlv_tree, tvb, stlv_offset+4, 1, "Protection Capability: %s (0x%x)",
                                        val_to_str(tvb_get_guint8(tvb,stlv_offset+4), gmpls_protection_cap_str, "Unknown (%d)"),tvb_get_guint8(tvb,stlv_offset+4));
                    break;
-               
+
                case MPLS_LINK_SHARED_RISK_GROUP:
                    ti = proto_tree_add_text(tlv_tree, tvb, stlv_offset, stlv_len+4,
                                             "%s", stlv_name);
@@ -1791,8 +1794,8 @@ dissect_ospf_lsa_mpls(tvbuff_t *tvb, int offset, proto_tree *tree,
                    proto_tree_add_text(stlv_tree, tvb, stlv_offset+2, 2, "TLV Length: %u",
                                        stlv_len);
                    for (i=0; i < stlv_len; i+=4)
-                       proto_tree_add_text(stlv_tree, tvb, stlv_offset+4+i, 4, "Shared Risk Link Group: %u", 
-                                       tvb_get_ntohl(tvb,stlv_offset+4+i)); 
+                       proto_tree_add_text(stlv_tree, tvb, stlv_offset+4+i, 4, "Shared Risk Link Group: %u",
+                                       tvb_get_ntohl(tvb,stlv_offset+4+i));
                    break;
 
                case OIF_LOCAL_NODE_ID:
@@ -2127,10 +2130,10 @@ dissect_ospf_v2_lsa(tvbuff_t *tvb, int offset, proto_tree *tree,
 
            nr_tos = tvb_get_guint8(tvb, offset + 9);
 
-            
+
             ti_local = proto_tree_add_text(ospf_lsa_tree, tvb, offset, 12 + 4 * nr_tos,
                                      "Type: %-8s ID: %-15s Data: %-15s Metric: %d",
-                                     link_type_short_str, 
+                                     link_type_short_str,
                                      ip_to_str(tvb_get_ptr(tvb, offset, 4)),
                                      ip_to_str(tvb_get_ptr(tvb, offset + 4, 4)),
                                      tvb_get_ntohs(tvb, offset + 10));

diff --git a/epan/dissectors/packet-pktc.c b/epan/dissectors/packet-pktc.c
index 54405a4d7bcc4d25db1478dbcf7e046399ffe7c8..ba865e980b20a01522fdbb2cace496a4ad443878 100644 (file)
--- a/epan/dissectors/packet-pktc.c
+++ b/epan/dissectors/packet-pktc.c
@@ -2,8 +2,8 @@
  * Routines for PacketCable (PKTC) Kerberized Key Management and
  *              PacketCable (PKTC) MTA FQDN                  packet disassembly
  *
- * References: 
- * [1] PacketCable 1.0 Security Specification, PKT-SP-SEC-I11-040730, July 30, 
+ * References:
+ * [1] PacketCable 1.0 Security Specification, PKT-SP-SEC-I11-040730, July 30,
  *     2004, Cable Television Laboratories, Inc., http://www.PacketCable.com/
  *
  * Ronnie Sahlberg 2004
@@ -226,8 +226,8 @@ dissect_pktc_app_specific_data(packet_info *pinfo _U_, proto_tree *parent_tree,
         break;
     case DOI_IPSEC:
         switch(kmmid){
-        /* we dont distinguish between SPIs for inbound Security Associations 
-          of the client (AP-REQ) vs. server (AP-REP, REKEY). Feel free to add 
+        /* we dont distinguish between SPIs for inbound Security Associations
+          of the client (AP-REQ) vs. server (AP-REP, REKEY). Feel free to add
           separation for this if it is imporant enough for you. */
         case KMMID_AP_REQUEST:
         case KMMID_AP_REPLY:
@@ -335,7 +335,7 @@ dissect_pktc_ap_request(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int
     guint32 snonce;
 
     /* AP Request  kerberos blob */
-    pktc_tvb = tvb_new_subset(tvb, offset, -1, -1); 
+    pktc_tvb = tvb_new_subset(tvb, offset, -1, -1);
     offset += dissect_kerberos_main(pktc_tvb, pinfo, tree, FALSE, NULL);
 
     /* Server Nonce */
@@ -366,7 +366,7 @@ dissect_pktc_ap_reply(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int o
     tvbuff_t *pktc_tvb;
 
     /* AP Reply  kerberos blob */
-    pktc_tvb = tvb_new_subset(tvb, offset, -1, -1); 
+    pktc_tvb = tvb_new_subset(tvb, offset, -1, -1);
     offset += dissect_kerberos_main(pktc_tvb, pinfo, tree, FALSE, NULL);
 
     /* app specific data */
@@ -431,8 +431,8 @@ dissect_pktc_rekey(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offs
     /* Timestamp: YYMMDDhhmmssZ */
     /* They really came up with a two-digit year in late 1990s! =8o */
     timestr=tvb_get_ptr(tvb, offset, 13);
-    proto_tree_add_string_format(tree, hf_pktc_timestamp, tvb, offset, 13, timestr, 
-                                "%s: %.2s-%.2s-%.2s %.2s:%.2s:%.2s", 
+    proto_tree_add_string_format(tree, hf_pktc_timestamp, tvb, offset, 13, timestr,
+                                "%s: %.2s-%.2s-%.2s %.2s:%.2s:%.2s",
                                 proto_registrar_get_name(hf_pktc_timestamp),
                                 timestr, timestr+2, timestr+4, timestr+6, timestr+8, timestr+10);
     offset+=13;
@@ -468,7 +468,7 @@ dissect_pktc_error_reply(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, in
     tvbuff_t *pktc_tvb;
 
     /* KRB_ERROR */
-    pktc_tvb = tvb_new_subset(tvb, offset, -1, -1); 
+    pktc_tvb = tvb_new_subset(tvb, offset, -1, -1);
     offset += dissect_kerberos_main(pktc_tvb, pinfo, tree, FALSE, NULL);
 
     return offset;
@@ -488,7 +488,7 @@ dissect_pktc_mtafqdn_krbsafeuserdata(packet_info *pinfo, tvbuff_t *tvb, proto_tr
     offset+=1;
 
     if (check_col(pinfo->cinfo, COL_INFO))
-        col_set_str(pinfo->cinfo, COL_INFO, 
+        col_set_str(pinfo->cinfo, COL_INFO,
                    val_to_str(msgtype, pktc_mtafqdn_msgtype_vals, "MsgType %u"));
 
     /* enterprise */
@@ -512,7 +512,7 @@ dissect_pktc_mtafqdn_krbsafeuserdata(packet_info *pinfo, tvbuff_t *tvb, proto_tr
        /* manufacturer cert revocation time */
        bignum = tvb_get_ntohl(tvb, offset);
        ts.secs = bignum;
-       proto_tree_add_time_format(tree, hf_pktc_mtafqdn_manu_cert_revoked, tvb, offset, 4, 
+       proto_tree_add_time_format(tree, hf_pktc_mtafqdn_manu_cert_revoked, tvb, offset, 4,
                                   &ts, "%s: %s",
                                   proto_registrar_get_name(hf_pktc_mtafqdn_manu_cert_revoked),
                                   (bignum==0) ? "not revoked" : abs_time_secs_to_str(bignum));
@@ -521,12 +521,13 @@ dissect_pktc_mtafqdn_krbsafeuserdata(packet_info *pinfo, tvbuff_t *tvb, proto_tr
     case PKTC_MTAFQDN_REP:
         /* MTA FQDN */
         string_len = tvb_length_remaining(tvb, offset) - 4;
-       proto_tree_add_item(tree, hf_pktc_mtafqdn_fqdn, tvb, offset, string_len, FALSE); 
-       offset+=string_len;
+        DISSECTOR_ASSERT(string_len > 0);
+        proto_tree_add_item(tree, hf_pktc_mtafqdn_fqdn, tvb, offset, string_len, FALSE);
+        offset+=string_len;
 
         /* MTA IP address */
-       tvb_memcpy(tvb, (guint8 *)&bignum, offset, sizeof(bignum));
-       proto_tree_add_ipv4(tree, hf_pktc_mtafqdn_ip, tvb, offset, 4, bignum);
+        tvb_memcpy(tvb, (guint8 *)&bignum, offset, sizeof(bignum));
+        proto_tree_add_ipv4(tree, hf_pktc_mtafqdn_ip, tvb, offset, 4, bignum);
 
         break;
     }
@@ -562,11 +563,11 @@ dissect_pktc_mtafqdn(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 
 
     /* KRB_AP_RE[QP] */
-    pktc_mtafqdn_tvb = tvb_new_subset(tvb, offset, -1, -1); 
+    pktc_mtafqdn_tvb = tvb_new_subset(tvb, offset, -1, -1);
     offset += dissect_kerberos_main(pktc_mtafqdn_tvb, pinfo, pktc_mtafqdn_tree, FALSE, NULL);
 
     /* KRB_SAFE */
-    pktc_mtafqdn_tvb = tvb_new_subset(tvb, offset, -1, -1); 
+    pktc_mtafqdn_tvb = tvb_new_subset(tvb, offset, -1, -1);
     offset += dissect_kerberos_main(pktc_mtafqdn_tvb, pinfo, pktc_mtafqdn_tree, FALSE, cb);
 
     proto_item_set_len(item, offset);
@@ -598,7 +599,7 @@ dissect_pktc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
     doi=tvb_get_guint8(tvb, offset);
     proto_tree_add_uint(pktc_tree, hf_pktc_doi, tvb, offset, 1, doi);
     offset+=1;
-    
+
     /* version */
     version=tvb_get_guint8(tvb, offset);
     proto_tree_add_text(pktc_tree, tvb, offset, 1, "Version: %d.%d", (version>>4)&0x0f, (version)&0x0f);
@@ -608,7 +609,7 @@ dissect_pktc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 
     /* fill COL_INFO */
     if (check_col(pinfo->cinfo, COL_INFO)) {
-        col_add_str(pinfo->cinfo, COL_INFO, 
+        col_add_str(pinfo->cinfo, COL_INFO,
                    val_to_str(kmmid, kmmid_types, "Unknown KMMID %#x"));
        col_append_fstr(pinfo->cinfo, COL_INFO, " (%s)",
                        val_to_str(doi, doi_types, "Unknown DOI %#x"));

diff --git a/epan/dissectors/packet-rpc.c b/epan/dissectors/packet-rpc.c
index 4e89de5057644360072575004a31b63d39897661..dade1815354ea1ed43e048d3cee5eb9772b4622d 100644 (file)
--- a/epan/dissectors/packet-rpc.c
+++ b/epan/dissectors/packet-rpc.c
@@ -485,7 +485,10 @@ unsigned int
 rpc_roundup(unsigned int a)
 {
        unsigned int mod = a % 4;
-       return a + ((mod)? 4-mod : 0);
+        unsigned int ret;
+       ret = a + ((mod)? 4-mod : 0);
+        /* Check for overflow */
+        DISSECTOR_ASSERT(ret >= a);
 }