aboutsummaryrefslogtreecommitdiffstats
path: root/epan/reassemble.c
AgeCommit message (Collapse)AuthorFilesLines
2015-11-06reassemble: Add key destroy function to g_hash_tableJoão Valverde1-5/+9
Fixes memleak in reassemble.c 480 bytes in 60 blocks are definitely lost in loss record 3,010 of 3,059 at 0x4C28C10: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) by 0xADA3328: g_malloc (in /usr/lib/libglib-2.0.so.0.4600.1) by 0xADBA512: g_slice_alloc (in /usr/lib/libglib-2.0.so.0.4600.1) by 0x6575C7D: fragment_reassembled (reassemble.c:804) by 0x6577785: fragment_add_seq_check_work (reassemble.c:2027) by 0x6577880: fragment_add_seq_next (reassemble.c:2068) by 0x6E614E6: dissect_sccp_message (packet-sccp.c:2875) by 0x6E63641: dissect_sccp (packet-sccp.c:3401) by 0x6546CF7: call_dissector_through_handle (packet.c:620) by 0x6546EA1: call_dissector_work (packet.c:706) by 0x6547A04: dissector_try_uint_new (packet.c:1163) by 0x6547A65: dissector_try_uint (packet.c:1189) Change-Id: I0117b48e1e5d5688c49f264f24387dd6de1d6e08 Reviewed-on: https://code.wireshark.org/review/11541 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-11-04Don't include "file.h" if you don't need it.Guy Harris1-0/+2
It ends up dragging in libwireshark headers, which programs not linking with libwireshark shouldn't do. In particular, including <epan/address.h> causes some functions that refer to libwireshark functions to be defined if the compiler doesn't handle "static inline" the way GCC does, and you end up requiring libwireshark even though you shouldn't require it. Move plurality() to wsutil/str_util.h, so that non-libwireshark code can get it without include epan/packet.h. Fix includes as necessary. Change-Id: Ie4819719da4c2b349f61445112aa419e99b977d3 Reviewed-on: https://code.wireshark.org/review/11545 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-10-22Use address functions instead of ADDRESS macros in asn1 and epanGerald Combs1-8/+8
Replace CMP_ADDRESS, COPY_ADDRESS, et al with their lower-case equivalents in the asn1 and epan directories. Change-Id: I4043b0931d4353d60cffbd829e30269eb8d08cf4 Reviewed-on: https://code.wireshark.org/review/11200 Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-06-24Remove deprecated tvb_length callsEvan Huus1-7/+7
Trust that the files in epan/ immediately (not dissectors) know what they're doing so just blindly convert them to captured length. Change-Id: I872f7d58b2e15ae82c75fd56f4873996fbc97be7 Reviewed-on: https://code.wireshark.org/review/9083 Reviewed-by: Evan Huus <eapache@gmail.com>
2015-04-21reassembly: address a 15-year old XXX commentEvan Huus1-2/+4
Question: "what if we didn't capture the entire fragment due to a too-short snapshot length?" Answer: An assertion fails and we leak a bunch of memory. Don't do that. Bug: 11129 Change-Id: I0adfb217f0e66ae8f5f6255a4caf7ff940826b59 Reviewed-on: https://code.wireshark.org/review/8128 Petri-Dish: Evan Huus <eapache@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Evan Huus <eapache@gmail.com>
2015-03-18[Reassembly] Fix a reassembly case where the two fragments are in the sameAndersBroman1-1/+8
frame but in different SCTP DATA chunks, whitout the patch the message is reassembled in both chunks leading to duplicated upper layer PDU:s in the frame. Change-Id: Ie31142c38c728018178947544b571622447d8e8f Reviewed-on: https://code.wireshark.org/review/7716 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2015-01-18Remove some apparently-unnecessary includes of emem.h.Guy Harris1-1/+0
Change-Id: Ib7d1b587b439ff21ec6b7f1756ce6ccf25b66f80 Reviewed-on: https://code.wireshark.org/review/6635 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2014-09-25reassembly: fix when fragment cut off by snapshotEvan Huus1-2/+7
Also add an assertion to tvb_generic_clone_offset_len so that it throws an error *before* allocating memory, as otherwise that memory is leaked. Bug: 10474 Change-Id: I5036cefac16841914a59670c64979cf599bf7969 Reviewed-on: https://code.wireshark.org/review/4234 Petri-Dish: Evan Huus <eapache@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Evan Huus <eapache@gmail.com>
2014-09-16Fix spelling: cant-->can't, wont-->won't, etcBill Meier1-2/+2
Change-Id: Ia6c3e7a25615bf8e052c3bacf096d76df775c9c2 Reviewed-on: https://code.wireshark.org/review/4126 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2014-03-04Remove all $Id$ from top of fileAlexis La Goutte1-2/+0
(Using sed : sed -i '/^ \* \$Id\$/,+1 d') Fix manually some typo (in export_object_dicom.c and crc16-plain.c) Change-Id: I4c1ae68d1c4afeace8cb195b53c715cf9e1227a8 Reviewed-on: https://code.wireshark.org/review/497 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2014-02-25Remove trailing whitespaceBill Meier1-7/+7
Change-Id: I8116f63ff88687c8db3fd6e8e23b22ab2f759af0 Reviewed-on: https://code.wireshark.org/review/385 Reviewed-by: Bill Meier <wmeier@newsguy.com> Tested-by: Bill Meier <wmeier@newsguy.com>
2013-11-10Add missing includes in order to remove exceptions.h from proto.h (next commit).Jakub Zawadzki1-0/+1
svn path=/trunk/; revision=53230
2013-11-07Revert r53118 as it breaks reassemble_test.Michael Mann1-5/+5
svn path=/trunk/; revision=53130
2013-11-06Correctly report segments marked with REASSEMBLE_FLAGS_NO_FRAG_NUMBER. Bug ↵Michael Mann1-5/+5
9304 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9304) Instead of incrementing the offset for each new segment by one we add the length of the segment so that each segment is correctly shown in the segment list. It proves to be very useful to find which packet (segment) is causing an application dissector to go wrong. From Matthieu Patou svn path=/trunk/; revision=53118
2013-10-08Reorganize handling of incomplete fragments slightly. The logic hasn't changedEvan Huus1-9/+15
much, but I think this way's a little clearer, and it made it much easier to figure out where the memory leak was. Fixes the leaks from https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9243 svn path=/trunk/; revision=52448
2013-10-01Remove check_col.Michael Mann1-5/+2
svn path=/trunk/; revision=52316
2013-09-13Explicitly include emem.h where it is neededJörg Mayer1-2/+1
svn path=/trunk/; revision=51997
2013-09-07- no need for a doubly-linked list of TVBs, single is simplerEvan Huus1-1/+3
- support merging chains in tvb_add_to_chain - when we have an old reassembled TVB, just merge the chains rather than freeing it (we may still need it as it may already be a data source) - modelines Fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9027 #BACKPORT, but it's gonna be messy... svn path=/trunk/; revision=51825
2013-07-17Remove fragment_data, add fragment_head, fragment_item - for now alias it to ↵Jakub Zawadzki1-79/+81
the same structure. This is begin of work to split fragment head and fragments items. svn path=/trunk/; revision=50708
2013-07-14A bit more comment updating.Guy Harris1-1/+1
svn path=/trunk/; revision=50590
2013-07-14Fix a comment.Guy Harris1-4/+4
svn path=/trunk/; revision=50588
2013-07-14Cast the result of g_malloc(), to avoid warnings about trying to compileGuy Harris1-4/+4
this code as C++. Make pointers to raw packet data pointers to guint8, not pointers to char, as they're octets, not characters. svn path=/trunk/; revision=50583
2013-07-14Rewrite reassemble API to use TVBs instead of raw data.Jakub Zawadzki1-68/+69
(it seems to be working for TCP ^^) svn path=/trunk/; revision=50580
2013-06-04From Anthony Coddington:Anders Broman1-0/+6
show_fragment_seq_tree does not add reassembled data tree item https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8766 svn path=/trunk/; revision=49751
2013-04-22Fix some Dead Store (Dead initialization) Warning found by Clang Fix also ↵Alexis La Goutte1-10/+10
indent (Use tabs) svn path=/trunk/; revision=48983
2013-04-20Fix typo - we want to check if the pointer is NULL, not if the valueEvan Huus1-1/+1
pointed to is NULL. Part of https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8599 svn path=/trunk/; revision=48943
2013-04-18When we throw a reassembly error, remember the error, so that, if weGuy Harris1-105/+286
revisit this reassembly (in a multi-pass program such as Wireshark, or TShark with -2), we'll throw the same error. In fragment_set_tot_len(), allow the length to be set to a value that's before the offset of existing fragments; we'll catch that later when the reassembly completes. This lets us handle some problems with DTLS less confusingly. When adding frames to an already-completed reassembly, check for fragments that overlap existing fragments or go past the end of the reassembly, and report errors. When completing a reassembly, make the buffer for the reassembled data big enough to contain the specified data length for the reassembly, even if that's less than the offset + length of the last fragment. Flag all fragments that go past that length as "too long", and only copy out what part of them fits, if any. That lets us flag the correct fragment or fragments as being "too long". When adding fragments, do some additional checks, even if we're not doing the first pass through the packets, so errors that show up in the first pass also show up on subsequent passes. svn path=/trunk/; revision=48909
2013-03-25Include a message with all ReassemblyError exceptions; they're expectedGuy Harris1-1/+1
to have a message indicating the precise error. svn path=/trunk/; revision=48554
2013-03-25From Roland Knall via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8502Evan Huus1-2/+31
Allow reassembly of sequences when the sequence numbers do not count from 0. svn path=/trunk/; revision=48548
2013-03-24make local functions static.Anders Broman1-1/+1
svn path=/trunk/; revision=48523
2013-03-23Make reassembly_table_destroy() clear the function pointers and emptyGuy Harris1-0/+32
and destroy the reassembled table. svn path=/trunk/; revision=48492
2013-03-22Don't wire into the reassembly code the notion that reassemblies shouldGuy Harris1-463/+463
be done on flows from one address to another; reassembly for protocols running atop TCP should be done on flows from one TCP endpoint to another. We do this by: adding "reassembly table" as a data structure; associating hash tables for both in-progress reassemblies and completed reassemblies with that data structure (currently, not all reassemblies use the latter; they might keep completed reassemblies in the first table); having functions to create and destroy keys in that table; offering standard routines for doing address-based and address-and-port-based flow processing, so that dissectors not needing their own specialized flow processing can just use them. This fixes some mis-reassemblies of NIS YPSERV YPALL responses (where the second YPALL response is processed as if it were a continuation of a previous response between different endpoints, even though said response is already reassembled), and also allows the DCE RPC-specific stuff to be moved out of epan/reassembly.c into the DCE RPC dissector. svn path=/trunk/; revision=48491
2013-03-15From beroset:Anders Broman1-23/+23
remove C++ incompatibilities https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8416 svn path=/trunk/; revision=48318
2013-03-06Followup to r48011, answering my own XXX comment:Evan Huus1-3/+1
No, ReportedBoundsError is not the right thing to throw, ReassemblyError is. That's why I added it in the first place! svn path=/trunk/; revision=48123
2013-03-02Define a new exception for reassembly errors, and throw it in several casesEvan Huus1-34/+47
instead of using DISSECTOR_ASSERT. When a dissector passes bad data to the reassembly machine, that isn't necessarily the dissector's fault - the data may come straight from the packet, and the dissector may not have enough information to know it's bad without telling the reassembly machine in the first place. Also fix a bug in the reassembly machine. If it were given a fragment and all of the following conditions were met: - the other associated fragments were already marked as done (reassembled) - the fragment went beyond the end of the conceptual reassembled buffer - the dissector had not set the PARTIAL_REASSEMBLY flag then the reassembly machine would incorrectly think there was an overlap and run past the end of the already-reassembled buffer. Should fix the rest of https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8380 #BACKPORT This is probably too big and intrusive to backport directly, and parts of it will need adapting anyways since reassemble.c has changed. But the bug exists and crashes in 1.6 and 1.8, so we'll have to do something. svn path=/trunk/; revision=48011
2013-01-08From Evan:Martin Kaiser1-5/+33
sanity checks before setting a packet's total length in fragment_set_tot_len() (from me: check if fragments exist for the given id) hopefully, this fixes #8111 and #8163 without causing troubles for other protocols that use fragmentation and reassembly svn path=/trunk/; revision=46999
2012-12-27Add full modelines and minor whitespace fixes.Evan Huus1-3/+8
svn path=/trunk/; revision=46812
2012-09-20We always HAVE_CONFIG_H so don't bother checking whether we have it or not.Jeff Morriss1-3/+1
svn path=/trunk/; revision=45016
2012-09-07From Robert Bullen via ↵Jeff Morriss1-0/+6
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7683 : The reassembled fragments tree in the Packet Details view is awesome, but it lacks one thing: a field that exposes the reassembled data. tcp.data already exists for exposing a single TCP segment's payload as a byte array. It would be handy to have something similar for a single application layer PDU when TCP segment reassembly is involved. I propose tcp.reassembled.data, named and placed after the already existing field tcp.reassembled.length. My primary use case for this feature is outputting tcp.reassembled.data with tshark for further processing with a script. The attached patch implements this very feature. Because the reassembled fragment tree code is general purpose, i.e. not specific to just TCP, any dissector that relies upon it can add a similar field very cheaply. In that vein I've also implemented ip.reassembled.data and ipv6.reassembled.data, which expose reassembled fragment data as a single byte stream for IPv4 and IPv6, respectively. All other protocols that use the reassembly code have been left alone, other than inserting NULL into their initializer lists for the newly introduced struct field reassemble.h:fragment_items.hf_reassembled_data. svn path=/trunk/; revision=44802
2012-08-12Add 'fragment_table_destroy()' Bill Meier1-2/+26
svn path=/trunk/; revision=44459
2012-08-09Use g_slice allocation for 'reassembled_table' keys (instead of se allocation).Bill Meier1-10/+10
Not strictly required, but IMO a bit cleaner (if maybe a bit less efficient). svn path=/trunk/; revision=44382
2012-08-09From Jakub Zawadzki: Fix for memory leak in reassemble.cBill Meier1-13/+33
Bug #4141 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4141#c10 svn path=/trunk/; revision=44371
2012-06-28Update Free Software Foundation address.Jakub Zawadzki1-1/+1
(COPYING will be updated in next commit) svn path=/trunk/; revision=43536
2012-02-28Fix https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3315 -Jeff Morriss1-3/+5
make Save-As/Displayed/All-Packets save not only the displayed packets but also any other packets needed (e.g., for reassembly) to fully dissect the displayed packets. This works only for the "All packets" case; choosing only the Selected packet, the Marked packets, or a range of packets would require actually storing which packets depend on which (too much memory) or going through the packet list many times (too slow). Also, this behavior is always the case: you can't save the displayed packets without their dependencies (I don't see why this would be desirable). So far this is done for SCTP and things using the reassembly routines (TCP has been tested). The Win32 dialog was modified but hasn't been tested yet. One confusing aspect of the UI is that the Displayed count in the Save-As dialog does not match the number of displayed packets. (I tried renaming the button "Displayed + Dependencies" but it looked too big.) The tooltip tries to explain this and the fact that this works only in the All-Packets case; suggestions for improvement are welcome. Implementation details: Dissectors (or the reassembly code) can list frames which were needed to build the current frame's tree. If the current frame passes the display filter then each listed frame is marked as "depended upon" (this takes up the last free frame_data flag). When performing a Save-As/Displayed/All-Packets then choose packets which passed the dfilter _or_ are depended upon. svn path=/trunk/; revision=41216
2012-01-14Remove obsolete comments referring to mem_chunks.Bill Meier1-7/+4
svn path=/trunk/; revision=40507
2012-01-14Remove obsolete GLIB_CHECK_VERSION(2,10,0) checksJörg Mayer1-39/+0
svn path=/trunk/; revision=40490
2011-09-22(Trivial) Fix a typo in a comment.Bill Meier1-1/+1
svn path=/trunk/; revision=39089
2011-07-19Use ENC_NA for hf_fragments (FT_NONE).Stig Bjørlykke1-4/+2
svn path=/trunk/; revision=38124
2011-07-11More GLIB_CHECK_VERSION cleanups. Update the minimum GLib/GTK+ versionsGerald Combs1-108/+5
in README.devloper. Remove g_gnuc.h since it's no longer needed. Remove tvbuff_init(), tvbuff_cleanup(), reassemble_init(), and reassemble_cleanup() since they were only used for older GLib versions which didn't support GSlices. Assume we always support the "matches" operator. svn path=/trunk/; revision=37978
2011-05-13As suggested by Anders: back out 37112.Jeff Morriss1-40/+4
svn path=/trunk/; revision=37123
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-10 16:14:46 +0000