Keep the MEGACO dissector from looping on a malformed events descriptor.

svn path=/trunk/; revision=23449

1 files changed, 70 insertions, 69 deletions

diff --git a/epan/dissectors/packet-megaco.c b/epan/dissectors/packet-megaco.c
index 39ed98585c..8a4e2f3e64 100644
--- a/epan/dissectors/packet-megaco.c
+++ b/epan/dissectors/packet-megaco.c
@@ -321,7 +321,7 @@ dissect_megaco_text(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 	guint8		tempchar;
 	gint		tvb_RBRKT, tvb_LBRKT,  RBRKT_counter, LBRKT_counter;
 	guint		token_index=0;
-	
+
 	gcp_msg_t* msg = NULL;
 	gcp_trx_t* trx = NULL;
 	gcp_ctx_t* ctx = NULL;
@@ -332,7 +332,7 @@ dissect_megaco_text(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 	guint32 ctx_id = 0;
 	gcp_cmd_type_t cmd_type = GCP_CMD_NONE;
 	gcp_wildcard_t wild_term = GCP_WILDCARD_NONE;
-	
+
 	top_tree=tree;
 	/* Initialize variables */
 	tvb_len						= tvb_length(tvb);
@@ -349,7 +349,7 @@ dissect_megaco_text(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 	RBRKT_counter				= 0;
 	LBRKT_counter				= 0;
 
-	msg = gcp_msg(pinfo, TVB_RAW_OFFSET(tvb), keep_persistent_data); 
+	msg = gcp_msg(pinfo, TVB_RAW_OFFSET(tvb), keep_persistent_data);
 
 	/*
 	 * Check to see whether we're really dealing with MEGACO by looking
@@ -365,9 +365,9 @@ dissect_megaco_text(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 	 */
 	if(!tvb_get_nstringz0(tvb,tvb_offset,sizeof(word),word)) return;
 
-	
-	
-	
+
+
+
 	if (strncasecmp(word, "MEGACO", 6) != 0 && tvb_get_guint8(tvb, tvb_offset ) != '!'){
 		gint8 class;
 		gboolean pc;
@@ -559,12 +559,12 @@ dissect_megaco_text(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 				tvb_format_text(tvb,tvb_previous_offset,len));
 
 				trx_id = strtoul(tvb_format_text(tvb,tvb_offset,len),NULL,10);
-				
+
 			if(tree)
 				my_proto_tree_add_string(message_body_tree, hf_megaco_transid, tvb,
 				tvb_previous_offset, len,
 				tvb_format_text(tvb,tvb_previous_offset,len));
-				
+
 				if(global_megaco_raw_text){
 					tvb_raw_text_add(tvb, megaco_tree);
 				}
@@ -582,7 +582,7 @@ dissect_megaco_text(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 			ti = proto_tree_add_text(megaco_tree, tvb, tvb_previous_offset, tvb_current_offset-tvb_previous_offset,
 				"%s",tvb_format_text(tvb, tvb_previous_offset, tvb_current_offset-tvb_previous_offset+1));
 			message_body_tree = proto_item_add_subtree(ti, ett_megaco_message_body);
-			
+
 			tvb_current_offset  = tvb_skip_wsp_return(tvb, tvb_current_offset-1);
 			len = tvb_current_offset - tvb_offset;
 			if (tree)
@@ -624,7 +624,7 @@ dissect_megaco_text(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 				col_add_fstr(pinfo->cinfo, COL_INFO, "%s Reply  ",
 				tvb_format_text(tvb,tvb_offset,len));
 				trx_id = strtoul(tvb_format_text(tvb,tvb_offset,len),NULL,10);
-			
+
 			if(tree)
 				my_proto_tree_add_string(message_body_tree, hf_megaco_transid, tvb,
 					tvb_offset, len, tvb_format_text(tvb,tvb_offset,len));
@@ -639,7 +639,7 @@ dissect_megaco_text(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 			/* Offset should be at first printarable char after { */
 			tvb_previous_offset = tvb_offset;
 			break;
-		case TRANSTOKEN:			
+		case TRANSTOKEN:
 			/* TransactionRequest 	*/
 			trx_type = GCP_TRX_REQUEST;
 			tvb_LBRKT  = tvb_find_guint8(tvb, tvb_offset, tvb_len, '{');
@@ -858,12 +858,12 @@ nextcontext:
 					RBRKT_counter = 0;
 					goto nextcontext;
 				}
-				
+
 				sub_ti = proto_tree_add_text(megaco_tree, tvb, tvb_command_start_offset, len+1,
 						"%s", tvb_format_text(tvb, tvb_command_start_offset, len+1));
 				megaco_tree_command_line = proto_item_add_subtree(sub_ti, ett_megaco_command_line);
 				/* creation of the megaco_tree_command_line additionally Command and Transaction ID will be printed in this line */
-				/* Changed to use the lines above. this code is saved if there is complaints 
+				/* Changed to use the lines above. this code is saved if there is complaints
 				sub_ti = proto_tree_add_item(megaco_tree,hf_megaco_command_line,tvb,tvb_command_start_offset,tokenlen, FALSE);
 				megaco_tree_command_line = proto_item_add_subtree(sub_ti, ett_megaco_command_line);
 				*/
@@ -919,7 +919,7 @@ nextcontext:
 									case GCP_TRX_REPLY: cmd_type = GCP_CMD_AUDITVAL_REQ; break;
 									default: cmd_type = GCP_CMD_NONE; break;
 								}
-								
+
 								my_proto_tree_add_string(megaco_tree_command_line, hf_megaco_command, tvb,
 									tvb_command_start_offset, tokenlen,
 									"AuditValue");
@@ -946,7 +946,7 @@ nextcontext:
 									case GCP_TRX_REPLY: cmd_type = GCP_CMD_ADD_REPLY; break;
 									default: cmd_type = GCP_CMD_NONE; break;
 								}
-								
+
 								my_proto_tree_add_string(megaco_tree_command_line, hf_megaco_command, tvb,
 									tvb_command_start_offset, tokenlen,
 									"Add");
@@ -962,7 +962,7 @@ nextcontext:
 								case GCP_TRX_REPLY: cmd_type = GCP_CMD_NOTIFY_REPLY; break;
 								default: cmd_type = GCP_CMD_NONE; break;
 							}
-							
+
 							my_proto_tree_add_string(megaco_tree_command_line, hf_megaco_command, tvb,
 								tvb_command_start_offset, tokenlen,
 								"Notify");
@@ -970,7 +970,7 @@ nextcontext:
 									col_append_str(pinfo->cinfo, COL_INFO, " Notify");
 							break;
 
-						case 'M': 
+						case 'M':
 
 							tempchar = tvb_get_guint8(tvb, tvb_command_start_offset+1);
 							if ( (tempchar >= 'a')&& (tempchar <= 'z'))
@@ -983,7 +983,7 @@ nextcontext:
 									case GCP_TRX_REPLY: cmd_type = GCP_CMD_MOD_REPLY; break;
 									default: cmd_type = GCP_CMD_NONE; break;
 								}
-								
+
 								my_proto_tree_add_string(megaco_tree_command_line, hf_megaco_command, tvb,
 									tvb_command_start_offset, tokenlen,
 									"Modify");
@@ -1007,7 +1007,7 @@ nextcontext:
 							break;
 
 						case 'P':
-							cmd_type = GCP_CMD_NONE; 
+							cmd_type = GCP_CMD_NONE;
 							/*
 							PackagesToken	= ("Packages"	/ "PG")
 							PendingToken	= ("Pending"	/ "PN")
@@ -1065,7 +1065,7 @@ nextcontext:
 									case GCP_TRX_REQUEST: cmd_type = GCP_CMD_SUB_REQ; break;
 									case GCP_TRX_REPLY: cmd_type = GCP_CMD_SUB_REPLY; break;
 									default: cmd_type = GCP_CMD_NONE; break;
-								}								
+								}
 								my_proto_tree_add_string(megaco_tree_command_line, hf_megaco_command, tvb,
 									tvb_command_start_offset, tokenlen,
 									"Subtract");
@@ -1088,13 +1088,13 @@ nextcontext:
 					}
 					else{
 						gchar* command = tvb_format_text(tvb, tvb_command_start_offset, tokenlen);
-						
+
 						if ( g_str_equal(command,"Subtract") ) {
 							switch(trx_type) {
 								case GCP_TRX_REQUEST: cmd_type = GCP_CMD_SUB_REQ; break;
 								case GCP_TRX_REPLY: cmd_type = GCP_CMD_SUB_REPLY; break;
 								default: cmd_type = GCP_CMD_NONE; break;
-							}								
+							}
 						} else if ( g_str_equal(command,"AuditValue") ) {
 							switch(trx_type) {
 								case GCP_TRX_REQUEST: cmd_type = GCP_CMD_AUDITVAL_REPLY; break;
@@ -1150,8 +1150,8 @@ nextcontext:
 								default: cmd_type = GCP_CMD_NONE; break;
 							}
 						}
-						
-						
+
+
 						my_proto_tree_add_string(megaco_tree_command_line, hf_megaco_command, tvb,
 							tvb_command_start_offset, tokenlen,
 							tvb_format_text(tvb, tvb_command_start_offset,
@@ -1159,16 +1159,16 @@ nextcontext:
 							if (check_col(pinfo->cinfo, COL_INFO) )
 								col_append_fstr(pinfo->cinfo, COL_INFO, " %s",command);
 					}
-					
+
 					if (cmd_type == GCP_CMD_NONE && trx_type == GCP_TRX_REPLY) {
 						cmd_type = GCP_CMD_REPLY;
 					}
-				
+
 					if (cmd_type != GCP_CMD_NONE) {
 						cmd = gcp_cmd(msg, trx, ctx, cmd_type, tvb_command_start_offset, keep_persistent_data);
 						tap_queue_packet(megaco_tap, pinfo, cmd);
 					}
-					
+
 					tvb_offset  = tvb_find_guint8(tvb, tvb_command_start_offset,
 						tvb_len, '=');
 					tvb_offset = tvb_skip_wsp(tvb, tvb_offset+1);
@@ -1196,7 +1196,7 @@ nextcontext:
 						term->str = (gchar*)(term->buffer = TermID);
 
 						term = gcp_cmd_add_term(msg, trx, cmd, term, wild_term, keep_persistent_data);
-						
+
 						/*** TERM ***/
 						my_proto_tree_add_string(megaco_tree_command_line, hf_megaco_termid, tvb,
 							tvb_offset, tokenlen,
@@ -1207,9 +1207,9 @@ nextcontext:
 						wild_term = GCP_WILDCARD_ALL;
 						term->len = 1;
 						term->buffer = (guint8*)(term->str = "*");
-						
+
 						term = gcp_cmd_add_term(msg, trx, cmd, term, wild_term, keep_persistent_data);
-						
+
 						my_proto_tree_add_string(megaco_tree_command_line, hf_megaco_termid, tvb,
 							tvb_offset, tokenlen,
 							"WildCard all");
@@ -1219,12 +1219,12 @@ nextcontext:
 
 					case '$':
 						wild_term = GCP_WILDCARD_CHOOSE;
-						
+
 						term->len = 1;
 						term->buffer = (guint8*)(term->str = "$");
-						
+
 						term = gcp_cmd_add_term(msg, trx, cmd, term, wild_term, keep_persistent_data);
-						
+
 						my_proto_tree_add_string(megaco_tree_command_line, hf_megaco_termid, tvb,
 							tvb_offset, tokenlen,
 							"WildCard any");
@@ -1238,12 +1238,12 @@ nextcontext:
 							tvb_offset, tokenlen,
 							tvb_format_text(tvb, tvb_offset,
 							tokenlen));
-						
+
 						term->len = tokenlen;
 						term->buffer = (guint8*)(term->str = tvb_format_text(tvb, tvb_offset, tokenlen));
-						
+
 						term = gcp_cmd_add_term(msg, trx, cmd, term, wild_term, keep_persistent_data);
-						
+
 							if (check_col(pinfo->cinfo, COL_INFO) )
 								col_append_fstr(pinfo->cinfo, COL_INFO, "=%s",tvb_format_text(tvb, tvb_offset,tokenlen));
 						break;
@@ -1319,14 +1319,14 @@ static const megaco_tokens_t megaco_descriptors_names[] = {
 		{ "Media",						"M" },	/* 3 */
 		{ "Signals",					"SG" }, /* 4 */
 		{ "Services",					"SV" },	/* 5 */
-		{ "Statistics",					"SA" }, /* 6 */			
-		{ "Error",						"ER" }, /* 7 */			
-		{ "Events",						"E" },	/* 8 */			
-		{ "Audit",						"AT" }, /* 9 */			
-		{ "DigitMap",					"DM" }, /* 10 */			
-		{ "ObservedEvents",				"OE" }, /* 11 */			
-		{ "Topology",					"TP" }, /* 12 */			
-		{ "Packages",					"PG" }, /* 13 */			
+		{ "Statistics",					"SA" }, /* 6 */
+		{ "Error",						"ER" }, /* 7 */
+		{ "Events",						"E" },	/* 8 */
+		{ "Audit",						"AT" }, /* 9 */
+		{ "DigitMap",					"DM" }, /* 10 */
+		{ "ObservedEvents",				"OE" }, /* 11 */
+		{ "Topology",					"TP" }, /* 12 */
+		{ "Packages",					"PG" }, /* 13 */
 };
 
 /* Returns index of megaco_tokens_t */
@@ -1420,7 +1420,7 @@ dissect_megaco_descriptors(tvbuff_t *tvb, proto_tree *megaco_tree_command_line,
 			if (!isalpha(tvb_get_guint8(tvb, tvb_offset ))){
 				break;
 			}
-		}		
+		}
 		tokenlen =  tvb_offset - tvb_previous_offset;
 		token_index = find_megaco_descriptors_names(tvb, tvb_previous_offset, tokenlen);
 		switch ( token_index ){
@@ -1488,8 +1488,8 @@ dissect_megaco_descriptors(tvbuff_t *tvb, proto_tree *megaco_tree_command_line,
 		tvb_previous_offset = tvb_skip_wsp(tvb, tvb_current_offset+1);
 		tvb_LBRKT = tvb_previous_offset;
 		tvb_RBRKT = tvb_previous_offset;
-	
-}while ( tvb_current_offset < tvb_descriptors_end_offset );
+
+    } while ( tvb_current_offset < tvb_descriptors_end_offset );
 
 }
 
@@ -1593,7 +1593,7 @@ dissect_megaco_mediadescriptor(tvbuff_t *tvb, proto_tree *megaco_tree_command_li
 	gint	mediaParm;
 
 
-	proto_tree  *megaco_mediadescriptor_tree, *megaco_mediadescriptor_ti; 
+	proto_tree  *megaco_mediadescriptor_tree, *megaco_mediadescriptor_ti;
 
 	tokenlen			= 0;
 	tvb_next_offset		= 0;
@@ -1615,7 +1615,7 @@ dissect_megaco_mediadescriptor(tvbuff_t *tvb, proto_tree *megaco_tree_command_li
 			}
 		}
 		tokenlen = tvb_next_offset - tvb_current_offset;
-		
+
 		mediaParm = find_megaco_mediaParm_names(tvb, tvb_current_offset, tokenlen);
 
 		tvb_LBRKT = tvb_find_guint8(tvb, tvb_next_offset , tvb_last_RBRKT, '{');
@@ -1629,13 +1629,13 @@ dissect_megaco_mediadescriptor(tvbuff_t *tvb, proto_tree *megaco_tree_command_li
 		switch ( mediaParm ){
 		case MEGACO_LOCAL_TOKEN:
 			tvb_current_offset = tvb_skip_wsp(tvb, tvb_LBRKT+1);
-			dissect_megaco_Localdescriptor(tvb,megaco_tree_command_line , pinfo, 
+			dissect_megaco_Localdescriptor(tvb,megaco_tree_command_line , pinfo,
 				tvb_RBRKT, tvb_current_offset);
 			tvb_current_offset = tvb_RBRKT;
 			break;
 		case MEGACO_REMOTE_TOKEN:
 			tvb_current_offset = tvb_skip_wsp(tvb, tvb_LBRKT+1);
-			dissect_megaco_Localdescriptor(tvb,megaco_tree_command_line , pinfo, 
+			dissect_megaco_Localdescriptor(tvb,megaco_tree_command_line , pinfo,
 				tvb_RBRKT, tvb_current_offset);
 			tvb_current_offset = tvb_RBRKT;
 			break;
@@ -1659,7 +1659,7 @@ dissect_megaco_mediadescriptor(tvbuff_t *tvb, proto_tree *megaco_tree_command_li
 			continue;
 		case MEGACO_TERMINATION_STATE_DESC:
 			tvb_current_offset = tvb_skip_wsp(tvb, tvb_LBRKT+1);
-			dissect_megaco_TerminationStatedescriptor(tvb,megaco_tree_command_line , 
+			dissect_megaco_TerminationStatedescriptor(tvb,megaco_tree_command_line ,
 				tvb_RBRKT, tvb_current_offset);
 			tvb_current_offset = tvb_RBRKT;
 			break;
@@ -1987,10 +1987,11 @@ dissect_megaco_eventsdescriptor(tvbuff_t *tvb, packet_info *pinfo, proto_tree *m
 
 			}
 
+			tvb_previous_offset = tvb_current_offset;
 			tvb_current_offset  = tvb_find_guint8(tvb, tvb_RBRKT,
 				tvb_events_end_offset, ',');
 
-			if (tvb_current_offset == -1 || tvb_current_offset > tvb_events_end_offset ){
+			if (tvb_current_offset == -1 || tvb_current_offset > tvb_events_end_offset || tvb_current_offset < tvb_previous_offset ) {
 				tvb_current_offset = tvb_events_end_offset;
 			}
 
@@ -2032,7 +2033,7 @@ dissect_megaco_signaldescriptor(tvbuff_t *tvb, packet_info *pinfo, proto_tree *m
 	else
 	  tokenlen = 7;								/* token must be verbose text (Signals) */
 
-	tvb_current_offset = tvb_skip_wsp(tvb, tvb_previous_offset+tokenlen);    
+	tvb_current_offset = tvb_skip_wsp(tvb, tvb_previous_offset+tokenlen);
 
 	if(tvb_get_guint8(tvb, tvb_current_offset)!='{') {			/* {} has been omitted */
 
@@ -2129,7 +2130,7 @@ dissect_megaco_signaldescriptor(tvbuff_t *tvb, packet_info *pinfo, proto_tree *m
 			megaco_requestedsignal_tree = proto_item_add_subtree(megaco_requestedsignal_ti, ett_megaco_requestedsignal);
 
 			proto_tree_add_item(megaco_requestedsignal_tree,hf_megaco_pkgdname,tvb,tvb_previous_offset,pkg_tokenlen, FALSE);
-			
+
 			if ( tvb_help_offset < tvb_RBRKT && tvb_help_offset != -1 ){
 				gchar *msg;
 
@@ -2258,7 +2259,7 @@ static gint find_megaco_megaco_serviceChangeParm_names(tvbuff_t *tvb, int offset
  * ServiceChangeReasons                                    References
  * --------------------                                    ----------
  */
-static const value_string MEGACO_ServiceChangeReasons_vals[] = {    
+static const value_string MEGACO_ServiceChangeReasons_vals[] = {
 	{900, "Service Restored"},
 	{901, "Cold Boot"},
 	{902, "Warm Boot"},
@@ -2275,8 +2276,8 @@ static const value_string MEGACO_ServiceChangeReasons_vals[] = {
 	{913, "Signal Capability Failure"},
 	{914, "Event Capability Failure"},
 	{915, "State Loss"},
-	{916, "Packages Change"},			
-	{917, "Capabilities Change"},	
+	{916, "Packages Change"},
+	{917, "Capabilities Change"},
 	{918, "Cancel Graceful"},
 	{919, "Warm Failover"},
 	{920, "Cold Failover"},
@@ -2334,8 +2335,8 @@ dissect_megaco_servicechangedescriptor(tvbuff_t *tvb, proto_tree *megaco_tree,
 			 */
 			item = proto_tree_add_text(megaco_tree, tvb, tvb_previous_offset, tokenlen,
 				"%s", tvb_format_text(tvb, tvb_previous_offset, tokenlen));
-			
-			/* As the reason code ( if a digit ) can be in quoted string or 'just' digit 
+
+			/* As the reason code ( if a digit ) can be in quoted string or 'just' digit
 			 * look for a nine and hope for the best.
 			 */
 			tvb_current_offset = tvb_find_guint8(tvb, tvb_previous_offset, tvb_RBRKT, '9');
@@ -2356,7 +2357,7 @@ dissect_megaco_servicechangedescriptor(tvbuff_t *tvb, proto_tree *megaco_tree,
 			/* No special dissection: fall trough */
 		default:
 		/* Unknown or:
-		 * extension            = extensionParameter parmValue 
+		 * extension            = extensionParameter parmValue
 		 * extensionParameter   = "X"  ("-" / "+") 1*6(ALPHA / DIGIT)
 		 */
 			proto_tree_add_text(megaco_tree, tvb, tvb_previous_offset, tokenlen,
@@ -2368,7 +2369,7 @@ dissect_megaco_servicechangedescriptor(tvbuff_t *tvb, proto_tree *megaco_tree,
 
 	}/*End while */
 
-	/* extension            = extensionParameter parmValue 
+	/* extension            = extensionParameter parmValue
 	 * extensionParameter   = "X"  ("-" / "+") 1*6(ALPHA / DIGIT)
 	 */
 
@@ -2436,7 +2437,7 @@ dissect_megaco_observedeventsdescriptor(tvbuff_t *tvb, packet_info *pinfo, proto
 
 
 	tvb_LBRKT = tvb_find_guint8(tvb, tvb_previous_offset, tvb_RBRKT, '{');
-	tvb_next_offset = tvb_LBRKT; 
+	tvb_next_offset = tvb_LBRKT;
 	tokenlen =  (tvb_next_offset+1) - tvb_previous_offset;
 
 	/*
@@ -2530,7 +2531,7 @@ dissect_megaco_observedeventsdescriptor(tvbuff_t *tvb, packet_info *pinfo, proto
 				"%s", tvb_format_text(tvb, tvb_previous_offset, tokenlen));
 
 			megaco_observedevent_tree = proto_item_add_subtree(megaco_observedevent_ti, ett_megaco_observedevent);
-			
+
 			proto_tree_add_item(megaco_observedevent_tree,hf_megaco_pkgdname,tvb,tvb_previous_offset,pkg_tokenlen, FALSE);
 
 			if ( tvb_help_offset < tvb_RBRKT && tvb_help_offset != -1 ){
@@ -3199,10 +3200,10 @@ dissect_megaco_LocalControldescriptor(tvbuff_t *tvb, proto_tree *megaco_mediades
 				tvb_current_offset, tokenlen,
 				tvb_format_text(tvb, tvb_current_offset,
 				tokenlen));
-			
+
 			tvb_get_nstringz0(tvb,tvb_current_offset,3,code_str);
 			proto_item_append_text(item,"[ %s ]", val_to_str(strtoul(code_str,NULL,16), dscp_vals,"Unknown (%u)"));
-			
+
 			tvb_current_offset = tvb_skip_wsp(tvb, tvb_offset +1);
 			break;
 
@@ -3289,7 +3290,7 @@ proto_reg_handoff_megaco(void)
 	h245_handle = find_dissector("h245dg");
 	h248_handle = find_dissector("h248");
 	data_handle = find_dissector("data");
-	
+
 	if (!megaco_prefs_initialized) {
 		megaco_text_handle = create_dissector_handle(dissect_megaco_text,
 			proto_megaco);
@@ -3468,7 +3469,7 @@ proto_register_megaco(void)
 		&ett_megaco_h245,
 		GCP_ETT_ARR_ELEMS(megaco_ctx_ids),
 	};
-	
+
 	module_t *megaco_module;
 
 	proto_megaco = proto_register_protocol("MEGACO",
@@ -3526,7 +3527,7 @@ proto_register_megaco(void)
 								   &keep_persistent_data);
 
 	megaco_tap = register_tap("megaco");
-	
+
 }