From 62ea3194ed6de70ed02d39084add4d63cd0962c4 Mon Sep 17 00:00:00 2001 From: Guy Harris Date: Fri, 16 Jan 2015 18:59:12 -0800 Subject: PacketLogger files can be big-endian or little-endian. Bug: 10861 Change-Id: Iedb248aa4a96e65bb525ba6475dc767e5dfefbe0 Reviewed-on: https://code.wireshark.org/review/6579 Reviewed-by: Guy Harris --- wiretap/packetlogger.c | 64 ++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 52 insertions(+), 12 deletions(-) (limited to 'wiretap/packetlogger.c') diff --git a/wiretap/packetlogger.c b/wiretap/packetlogger.c index 943cbc0ac3..bba8c4cbcc 100644 --- a/wiretap/packetlogger.c +++ b/wiretap/packetlogger.c @@ -35,9 +35,14 @@ #include "file_wrappers.h" #include "packetlogger.h" +typedef struct { + gboolean little_endian; +} packetlogger_t; + typedef struct packetlogger_header { guint32 len; - guint64 ts; + guint32 ts_secs; + guint32 ts_usecs; } packetlogger_header_t; static gboolean packetlogger_read(wtap *wth, int *err, gchar **err_info, @@ -46,17 +51,21 @@ static gboolean packetlogger_seek_read(wtap *wth, gint64 seek_off, struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info); static gboolean packetlogger_read_header(packetlogger_header_t *pl_hdr, - FILE_T fh, int *err, gchar **err_info); + FILE_T fh, gboolean little_endian, + int *err, gchar **err_info); static gboolean packetlogger_read_packet(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info); wtap_open_return_val packetlogger_open(wtap *wth, int *err, gchar **err_info) { + gboolean little_endian = FALSE; packetlogger_header_t pl_hdr; guint8 type; + packetlogger_t *packetlogger; - if(!packetlogger_read_header(&pl_hdr, wth->fh, err, err_info)) { + if(!packetlogger_read_header(&pl_hdr, wth->fh, little_endian, + err, err_info)) { if (*err != 0 && *err != WTAP_ERR_SHORT_READ) return WTAP_OPEN_ERROR; return WTAP_OPEN_NOT_MINE; @@ -68,6 +77,21 @@ wtap_open_return_val packetlogger_open(wtap *wth, int *err, gchar **err_info) return WTAP_OPEN_NOT_MINE; } + /* + * If the upper 16 bits of the length are non-zero and the lower + * 16 bits are zero, assume the file is little-endian. + */ + if ((pl_hdr.len & 0x0000FFFF) == 0 && + (pl_hdr.len & 0xFFFF0000) != 0) { + /* + * Byte-swap the upper 16 bits (the lower 16 bits are + * zero, so we don't have to look at them). + */ + pl_hdr.len = ((pl_hdr.len >> 24) & 0xFF) | + (((pl_hdr.len >> 16) & 0xFF) << 8); + little_endian = TRUE; + } + /* Verify this file belongs to us */ if (!((8 <= pl_hdr.len) && (pl_hdr.len < 65536) && (type < 0x04 || type == 0xFB || type == 0xFC || type == 0xFE || type == 0xFF))) @@ -77,6 +101,11 @@ wtap_open_return_val packetlogger_open(wtap *wth, int *err, gchar **err_info) if (file_seek(wth->fh, 0, SEEK_SET, err) == -1) return WTAP_OPEN_ERROR; + /* This is a PacketLogger file */ + packetlogger = (packetlogger_t *)g_malloc(sizeof(packetlogger_t)); + packetlogger->little_endian = little_endian; + wth->priv = (void *)packetlogger; + /* Set up the pointers to the handlers for this file type */ wth->subtype_read = packetlogger_read; wth->subtype_seek_read = packetlogger_seek_read; @@ -114,17 +143,26 @@ packetlogger_seek_read(wtap *wth, gint64 seek_off, struct wtap_pkthdr *phdr, } static gboolean -packetlogger_read_header(packetlogger_header_t *pl_hdr, FILE_T fh, int *err, - gchar **err_info) +packetlogger_read_header(packetlogger_header_t *pl_hdr, FILE_T fh, + gboolean little_endian, int *err, gchar **err_info) { if (!wtap_read_bytes_or_eof(fh, &pl_hdr->len, 4, err, err_info)) return FALSE; - if (!wtap_read_bytes(fh, &pl_hdr->ts, 8, err, err_info)) + if (!wtap_read_bytes(fh, &pl_hdr->ts_secs, 4, err, err_info)) + return FALSE; + if (!wtap_read_bytes(fh, &pl_hdr->ts_usecs, 4, err, err_info)) return FALSE; - /* Convert multi-byte values from big endian to host endian */ - pl_hdr->len = GUINT32_FROM_BE(pl_hdr->len); - pl_hdr->ts = GUINT64_FROM_BE(pl_hdr->ts); + /* Convert multi-byte values to host endian */ + if (little_endian) { + pl_hdr->len = GUINT32_FROM_LE(pl_hdr->len); + pl_hdr->ts_secs = GUINT32_FROM_LE(pl_hdr->ts_secs); + pl_hdr->ts_usecs = GUINT32_FROM_LE(pl_hdr->ts_usecs); + } else { + pl_hdr->len = GUINT32_FROM_BE(pl_hdr->len); + pl_hdr->ts_secs = GUINT32_FROM_BE(pl_hdr->ts_secs); + pl_hdr->ts_usecs = GUINT32_FROM_BE(pl_hdr->ts_usecs); + } return TRUE; } @@ -133,9 +171,11 @@ static gboolean packetlogger_read_packet(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info) { + packetlogger_t *packetlogger = (packetlogger_t *)wth->priv; packetlogger_header_t pl_hdr; - if(!packetlogger_read_header(&pl_hdr, fh, err, err_info)) + if(!packetlogger_read_header(&pl_hdr, fh, packetlogger->little_endian, + err, err_info)) return FALSE; if (pl_hdr.len < 8) { @@ -161,8 +201,8 @@ packetlogger_read_packet(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr, Buffer phdr->len = pl_hdr.len - 8; phdr->caplen = pl_hdr.len - 8; - phdr->ts.secs = (time_t) (pl_hdr.ts >> 32); - phdr->ts.nsecs = (int)((pl_hdr.ts & 0xFFFFFFFF) * 1000); + phdr->ts.secs = (time_t)pl_hdr.ts_secs; + phdr->ts.nsecs = (int)(pl_hdr.ts_usecs * 1000); return wtap_read_packet_bytes(fh, buf, phdr->caplen, err, err_info); } -- cgit v1.2.3