From 2f096100f5bcf5284111e62b51af23a9cbf4149b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=A0=D0=BE=D0=BC=D0=B0=D0=BD=20=D0=94=D0=BE=D0=BD=D1=87?= =?UTF-8?q?=D0=B5=D0=BD=D0=BA=D0=BE?= Date: Wed, 28 Dec 2016 22:59:50 +0300 Subject: cms: don't assert if eContent fails to be dissected If eContent is not an octet string, content_tvb will be null, and attempting to use it will trigger an assertion. Besides ill-formed files, this can also occur in old-style PKCS #7 files, since in PKCS #7 the corresponding field has the ANY type, rather than OCTET STRING. Change-Id: I9a5bce983aa82107a9602317737c183461cac7f3 Reviewed-on: https://code.wireshark.org/review/19448 Petri-Dish: Alexis La Goutte Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman --- epan/dissectors/asn1/cms/cms.cnf | 7 +++++-- epan/dissectors/packet-cms.c | 29 ++++++++++++++++------------- 2 files changed, 21 insertions(+), 15 deletions(-) (limited to 'epan') diff --git a/epan/dissectors/asn1/cms/cms.cnf b/epan/dissectors/asn1/cms/cms.cnf index 045dca9e9e..af60947754 100644 --- a/epan/dissectors/asn1/cms/cms.cnf +++ b/epan/dissectors/asn1/cms/cms.cnf @@ -102,9 +102,12 @@ RevocationInfoChoice/other otherRIC #.FN_BODY EncapsulatedContentInfo/eContent offset = dissect_ber_octet_string(FALSE, actx, tree, tvb, offset, hf_index, &content_tvb); - proto_item_set_text(actx->created_item, "eContent (%%u bytes)", tvb_reported_length (content_tvb)); - call_ber_oid_callback(object_identifier_id, content_tvb, 0, actx->pinfo, top_tree ? top_tree : tree, NULL); + if(content_tvb) { + proto_item_set_text(actx->created_item, "eContent (%%u bytes)", tvb_reported_length (content_tvb)); + + call_ber_oid_callback(object_identifier_id, content_tvb, 0, actx->pinfo, top_tree ? top_tree : tree, NULL); + } #.FN_PARS OtherRecipientInfo/oriType FN_VARIANT = _str VAL_PTR = &object_identifier_id diff --git a/epan/dissectors/packet-cms.c b/epan/dissectors/packet-cms.c index 482434de03..aafa52e46c 100644 --- a/epan/dissectors/packet-cms.c +++ b/epan/dissectors/packet-cms.c @@ -431,9 +431,12 @@ dissect_cms_T_eContent(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset #line 103 "./asn1/cms/cms.cnf" offset = dissect_ber_octet_string(FALSE, actx, tree, tvb, offset, hf_index, &content_tvb); - proto_item_set_text(actx->created_item, "eContent (%u bytes)", tvb_reported_length (content_tvb)); - call_ber_oid_callback(object_identifier_id, content_tvb, 0, actx->pinfo, top_tree ? top_tree : tree, NULL); + if(content_tvb) { + proto_item_set_text(actx->created_item, "eContent (%u bytes)", tvb_reported_length (content_tvb)); + + call_ber_oid_callback(object_identifier_id, content_tvb, 0, actx->pinfo, top_tree ? top_tree : tree, NULL); + } @@ -459,7 +462,7 @@ dissect_cms_EncapsulatedContentInfo(gboolean implicit_tag _U_, tvbuff_t *tvb _U_ static int dissect_cms_T_attrType(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) { -#line 130 "./asn1/cms/cms.cnf" +#line 133 "./asn1/cms/cms.cnf" const char *name = NULL; offset = dissect_ber_object_identifier_str(implicit_tag, actx, tree, tvb, offset, hf_cms_attrType, &object_identifier_id); @@ -479,7 +482,7 @@ dissect_cms_T_attrType(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset static int dissect_cms_AttributeValue(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) { -#line 140 "./asn1/cms/cms.cnf" +#line 143 "./asn1/cms/cms.cnf" offset=call_ber_oid_callback(object_identifier_id, tvb, offset, actx->pinfo, tree, NULL); @@ -741,7 +744,7 @@ dissect_cms_T_otherRevInfoFormat(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, i static int dissect_cms_T_otherRevInfo(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) { -#line 124 "./asn1/cms/cms.cnf" +#line 127 "./asn1/cms/cms.cnf" offset=call_ber_oid_callback(object_identifier_id, tvb, offset, actx->pinfo, tree, NULL); @@ -1078,7 +1081,7 @@ dissect_cms_T_keyAttrId(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset static int dissect_cms_T_keyAttr(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) { -#line 119 "./asn1/cms/cms.cnf" +#line 122 "./asn1/cms/cms.cnf" offset=call_ber_oid_callback(object_identifier_id, tvb, offset, actx->pinfo, tree, NULL); @@ -1266,7 +1269,7 @@ dissect_cms_T_oriType(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _ static int dissect_cms_T_oriValue(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) { -#line 113 "./asn1/cms/cms.cnf" +#line 116 "./asn1/cms/cms.cnf" offset=call_ber_oid_callback(object_identifier_id, tvb, offset, actx->pinfo, tree, NULL); @@ -1343,14 +1346,14 @@ dissect_cms_ContentEncryptionAlgorithmIdentifier(gboolean implicit_tag _U_, tvbu static int dissect_cms_EncryptedContent(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) { -#line 190 "./asn1/cms/cms.cnf" +#line 193 "./asn1/cms/cms.cnf" tvbuff_t *encrypted_tvb; proto_item *item; offset = dissect_ber_octet_string(implicit_tag, actx, tree, tvb, offset, hf_index, &encrypted_tvb); -#line 195 "./asn1/cms/cms.cnf" +#line 198 "./asn1/cms/cms.cnf" item = actx->created_item; @@ -1508,7 +1511,7 @@ dissect_cms_AuthenticatedData(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int static int dissect_cms_MessageDigest(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) { -#line 144 "./asn1/cms/cms.cnf" +#line 147 "./asn1/cms/cms.cnf" proto_item *pi; int old_offset = offset; @@ -1583,7 +1586,7 @@ dissect_cms_Countersignature(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int o static int dissect_cms_RC2ParameterVersion(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) { -#line 180 "./asn1/cms/cms.cnf" +#line 183 "./asn1/cms/cms.cnf" guint32 length = 0; offset = dissect_ber_integer(implicit_tag, actx, tree, tvb, offset, hf_index, @@ -1651,7 +1654,7 @@ dissect_cms_DigestInfo(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset static int dissect_cms_T_capability(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) { -#line 162 "./asn1/cms/cms.cnf" +#line 165 "./asn1/cms/cms.cnf" const char *name = NULL; offset = dissect_ber_object_identifier_str(implicit_tag, actx, tree, tvb, offset, hf_cms_attrType, &object_identifier_id); @@ -1672,7 +1675,7 @@ dissect_cms_T_capability(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offse static int dissect_cms_T_parameters(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, int offset _U_, asn1_ctx_t *actx _U_, proto_tree *tree _U_, int hf_index _U_) { -#line 173 "./asn1/cms/cms.cnf" +#line 176 "./asn1/cms/cms.cnf" offset=call_ber_oid_callback(object_identifier_id, tvb, offset, actx->pinfo, tree, NULL); -- cgit v1.2.3