diff options
author | Gerald Combs <gerald@wireshark.org> | 2010-09-30 16:24:33 +0000 |
---|---|---|
committer | Gerald Combs <gerald@wireshark.org> | 2010-09-30 16:24:33 +0000 |
commit | 256d7c8ff6f500bc1ebcae74108d6f616cffa14d (patch) | |
tree | 116d5dc92321440aabd81c60f8dd87ee3b5bf66e | |
parent | 81f713d849aa83d82ed28b2e523f0c4ab6fbbb37 (diff) | |
download | wireshark-master-1.0.tar.gz wireshark-master-1.0.tar.bz2 wireshark-master-1.0.zip |
Limit the amount of recursion in dissect_unknown_ber. Fixes bug 5230.master-1.0
svn path=/trunk-1.0/; revision=34286
-rw-r--r-- | epan/dissectors/packet-ber.c | 36 |
1 files changed, 24 insertions, 12 deletions
diff --git a/epan/dissectors/packet-ber.c b/epan/dissectors/packet-ber.c index 9267ff42b6..39c2d82e97 100644 --- a/epan/dissectors/packet-ber.c +++ b/epan/dissectors/packet-ber.c @@ -205,6 +205,14 @@ typedef struct _da_data { gpointer user_data; } da_data; +/* + * Set a limit on recursion so we don't blow away the stack. Another approach + * would be to remove recursion completely but then we'd exhaust CPU+memory + * trying to read a hellabyte of nested indefinite lengths. + * XXX - Max nesting in the ASN.1 plugin is 32. Should they match? + */ +#define BER_MAX_NESTING 500 + void dissect_ber_oid_NULL_callback(tvbuff_t *tvb _U_, packet_info *pinfo _U_, proto_tree *tree _U_) @@ -372,7 +380,8 @@ printf("dissect_ber_tagged_type(%s) entered\n",name); return offset; } -int dissect_unknown_ber(packet_info *pinfo, tvbuff_t *tvb, int offset, proto_tree *tree) +static int +try_dissect_unknown_ber(packet_info *pinfo, tvbuff_t *tvb, int offset, proto_tree *tree, gint nest_level) { int start_offset; gint8 class; @@ -388,6 +397,11 @@ int dissect_unknown_ber(packet_info *pinfo, tvbuff_t *tvb, int offset, proto_tre proto_item *pi, *cause; asn1_ctx_t asn1_ctx; + if (nest_level > BER_MAX_NESTING) { + /* Assume that we have a malformed packet. */ + THROW(ReportedBoundsError); + } + start_offset=offset; asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, TRUE, pinfo); @@ -448,7 +462,7 @@ int dissect_unknown_ber(packet_info *pinfo, tvbuff_t *tvb, int offset, proto_tre } item = proto_tree_add_item(tree, hf_ber_unknown_BER_OCTETSTRING, tvb, offset, len, FALSE); next_tree = proto_item_add_subtree(item, ett_ber_octet_string); - offset = dissect_unknown_ber(pinfo, tvb, offset, next_tree); + offset = try_dissect_unknown_ber(pinfo, tvb, offset, next_tree, nest_level+1); } else { offset = dissect_ber_octet_string(FALSE, &asn1_ctx, tree, tvb, start_offset, hf_ber_unknown_OCTETSTRING, NULL); } @@ -561,7 +575,7 @@ int dissect_unknown_ber(packet_info *pinfo, tvbuff_t *tvb, int offset, proto_tre next_tree=proto_item_add_subtree(item, ett_ber_SEQUENCE); } while(offset < (int)(start_offset + len + hdr_len)) - offset=dissect_unknown_ber(pinfo, tvb, offset, next_tree); + offset=try_dissect_unknown_ber(pinfo, tvb, offset, next_tree, nest_level+1); break; case BER_CLASS_APP: case BER_CLASS_CON: @@ -572,7 +586,7 @@ int dissect_unknown_ber(packet_info *pinfo, tvbuff_t *tvb, int offset, proto_tre next_tree=proto_item_add_subtree(item, ett_ber_SEQUENCE); } while(offset < (int)(start_offset + len + hdr_len)) - offset=dissect_unknown_ber(pinfo, tvb, offset, next_tree); + offset=try_dissect_unknown_ber(pinfo, tvb, offset, next_tree, nest_level+1); break; } @@ -583,6 +597,11 @@ int dissect_unknown_ber(packet_info *pinfo, tvbuff_t *tvb, int offset, proto_tre return offset; } +int +dissect_unknown_ber(packet_info *pinfo, tvbuff_t *tvb, int offset, proto_tree *tree) +{ + return try_dissect_unknown_ber(pinfo, tvb, offset, tree, 1); +} int call_ber_oid_callback(const char *oid, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree) @@ -763,13 +782,6 @@ int dissect_ber_identifier(packet_info *pinfo _U_, proto_tree *tree, tvbuff_t *t */ /* 8.1.3 Length octets */ -/* - * Set a limit on recursion so we don't blow away the stack. Another approach - * would be to remove recursion completely but then we'd exhaust CPU+memory - * trying to read a hellabyte of nested indefinite lengths. - * XXX - Max nesting in the ASN.1 plugin is 32. Should they match? - */ -#define BER_MAX_INDEFINITE_NESTING 500 static int try_get_ber_length(tvbuff_t *tvb, int offset, guint32 *length, gboolean *ind, gint nest_level) { guint8 oct, len; @@ -783,7 +795,7 @@ try_get_ber_length(tvbuff_t *tvb, int offset, guint32 *length, gboolean *ind, gi tmp_length = 0; tmp_ind = FALSE; - if (nest_level > BER_MAX_INDEFINITE_NESTING) { + if (nest_level > BER_MAX_NESTING) { /* Assume that we have a malformed packet. */ THROW(ReportedBoundsError); } |