Check for AVPs with a list of values and a type that's not a 32-bit or

shorter integral type.  Fixes bug 2027.

Rename the "bytes" pointer to "octetstring", and initialize it in a
fashion that makes it clearer that it points to the first of the basic
types, to make it clearer that it's for OctetString.

svn path=/trunk/; revision=23615

1 files changed, 38 insertions, 14 deletions

diff --git a/epan/dissectors/packet-diameter.c b/epan/dissectors/packet-diameter.c
index 699e97314f..129c887327 100644
--- a/epan/dissectors/packet-diameter.c
+++ b/epan/dissectors/packet-diameter.c
@@ -1,4 +1,3 @@
-
 /* packet-diameter.c
  * Routines for Diameter packet disassembly
  *
@@ -897,7 +896,30 @@ static diam_avp_t* build_simple_avp(const avp_type_t* type,
 									const char* name,
 									const value_string* vs,
 									void* data _U_) {
-	diam_avp_t* a = g_malloc0(sizeof(diam_avp_t));
+	diam_avp_t* a;
+
+	/*
+	 * Only 32-bit or shorter integral types can have a list of values.
+	 */
+	if (vs != NULL) {
+		switch (type->ft) {
+
+		case FT_UINT8:
+		case FT_UINT16:
+		case FT_UINT32:
+		case FT_INT8:
+		case FT_INT16:
+		case FT_INT32:
+			break;
+
+		default:
+			fprintf(stderr,"Diameter Dictionary: AVP %s has a list of values but isn't of a 32-bit or shorter integral type\n",
+			    name);
+			return NULL;
+		}
+	}
+
+	a = g_malloc0(sizeof(diam_avp_t));
 	a->code = code;
 	a->vendor = vendor;
 	a->dissector_v16 = type->v16;
@@ -959,7 +981,7 @@ extern int dictionary_load(void) {
 	gboolean do_dump_dict = getenv("WIRESHARK_DUMP_DIAM_DICT") ? TRUE : FALSE;
 	char* dir = ep_strdup_printf("%s" G_DIR_SEPARATOR_S "diameter" G_DIR_SEPARATOR_S, get_datafile_dir());
 	const avp_type_t* type;
-	const avp_type_t* bytes = basic_types;
+	const avp_type_t* octetstring = &basic_types[0];
 	diam_avp_t* avp;
 	GHashTable* vendors = g_hash_table_new(strcase_hash,strcase_equal);
 	diam_vnd_t* vnd;
@@ -1008,7 +1030,7 @@ extern int dictionary_load(void) {
 			parent = g_hash_table_lookup(build_dict.types,t->parent);
 		}
 
-		if (!parent) parent = bytes;
+		if (!parent) parent = octetstring;
 
 		/* insert the parent type for this type */
 		g_hash_table_insert(build_dict.types,t->name,(void*)parent);
@@ -1104,18 +1126,20 @@ extern int dictionary_load(void) {
 		if ( (!type) && a->type )
 			type = g_hash_table_lookup(build_dict.types,a->type);
 
-		if (!type) type = bytes;
+		if (!type) type = octetstring;
 
 		avp = type->build( type, a->code, vnd, a->name, vs, avp_data);
-		g_hash_table_insert(build_dict.avps, a->name, avp);
-
-		{
-			emem_tree_key_t k[] = {
-				{ 1, &(a->code) },
-				{ 1, &(vnd->code) },
-				{ 0 , NULL }
-			};
-			pe_tree_insert32_array(dictionary.avps,k,avp);
+		if (avp != NULL) {
+			g_hash_table_insert(build_dict.avps, a->name, avp);
+
+			{
+				emem_tree_key_t k[] = {
+					{ 1, &(a->code) },
+					{ 1, &(vnd->code) },
+					{ 0 , NULL }
+				};
+				pe_tree_insert32_array(dictionary.avps,k,avp);
+			}
 		}
 	}