From: Tobias Witek: Fix processing of radius 'vendor specific attributes'

In the RADIUS dissector, the function radius_register_avp_dissector() registers
vendors that are not already present in the dictionary hash-table. As far as I
can see, there are two problems with this:

1. The function does not set the number of type/length octets and the has_flags
 variable for that AVP, which is required to correctly decode AVP/VSA values
2. In some situations, the function is called _before_ radius_load_dictionary()
is called (for example for the vendor 3GPP (ID: 10415))

Therefore, all vendor entries that are created by calling
radius_register_avp_dissector() leave their type_octets and length_octets un-initialized,
which causes incorrect decoding.

[Result: Radius dissector displays messages such as:
 "Malformed Packet: RADIUS" and "Error/Malformed: Malformed Packet(Exception occurred)"]

The attached patch fixes this problem by assuming that the dictionary knows the
'ground truth' about the type/length octet and the has_flags information and allows it to
overwrite these values even for vendors that have already been loaded.

Also: (from Bill Meier): set the type/length octet and the has_flags variables to default
"standard" values (1,1,FALSE) in radius_register_avp_dissector().

Fixes Bug #3651 (and Bug #3635).
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3651
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3635


git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@28937 f5534014-38df-0310-8fa8-9805f1628bb7

1 files changed, 5 insertions, 0 deletions

diff --git a/epan/dissectors/packet-radius.c b/epan/dissectors/packet-radius.c
index 23ac77785a..e2e8a09456 100644
--- a/epan/dissectors/packet-radius.c
+++ b/epan/dissectors/packet-radius.c
@@ -1780,6 +1780,11 @@ extern void radius_register_avp_dissector(guint32 vendor_id, guint32 attribute_i
 			vendor->attrs_by_id = g_hash_table_new(g_direct_hash,g_direct_equal);
 			vendor->ett = no_vendor.ett;
 
+			/* XXX: Default "standard" values: Should be parameters ?  */
+			vendor->type_octets   = 1;
+			vendor->length_octets = 1;
+			vendor->has_flags     = FALSE; 
+
 			g_hash_table_insert(dict->vendors_by_id,GUINT_TO_POINTER(vendor->code),vendor);
 			g_hash_table_insert(dict->vendors_by_name,(gpointer)(vendor->name),vendor);
 		}