The Tcpdump Group git mirrors - tcpdump/blobdiff

index 52ffed4c87633e4e9f94cdac5f68136e2f2ace5d..f33a323fbf2c7c4037ec7ffd8a84c62c40e25aa3 100644 (file)

--- a/smbutil.c

+++ b/smbutil.c

@@ -145,7 +145,6 @@ name_interpret(netdissect_options *ndo,

if (in >= maxbuf)

return(-1); /* name goes past the end of the buffer */

if (in >= maxbuf)

return(-1); /* name goes past the end of the buffer */

- ND_TCHECK_1(in);

len = GET_U_1(in) / 2;

in++;

len = GET_U_1(in) / 2;

in++;

@@ -190,7 +189,6 @@ name_ptr(netdissect_options *ndo,

p = buf + ofs;

if (p >= maxbuf)

return(NULL); /* name goes past the end of the buffer */

p = buf + ofs;

if (p >= maxbuf)

return(NULL); /* name goes past the end of the buffer */

- ND_TCHECK_1(p);

c = GET_U_1(p);

@@ -244,14 +242,12 @@ name_len(netdissect_options *ndo,

if (s >= maxbuf)

return(-1); /* name goes past the end of the buffer */

if (s >= maxbuf)

return(-1); /* name goes past the end of the buffer */

- ND_TCHECK_1(s);

c = GET_U_1(s);

if ((c & 0xC0) == 0xC0)

return(2);

while (GET_U_1(s)) {

if (s >= maxbuf)

return(-1); /* name goes past the end of the buffer */

c = GET_U_1(s);

if ((c & 0xC0) == 0xC0)

return(2);

while (GET_U_1(s)) {

if (s >= maxbuf)

return(-1); /* name goes past the end of the buffer */

- ND_TCHECK_1(s);

s += GET_U_1(s) + 1;

ND_TCHECK_1(s);

}

s += GET_U_1(s) + 1;

ND_TCHECK_1(s);

}

@@ -296,7 +292,6 @@ smb_data_print(netdissect_options *ndo, const u_char *buf, u_int len)

return;

ND_PRINT("[%03X] ", i);

for (i = 0; i < len; /*nothing*/) {

return;

ND_PRINT("[%03X] ", i);

for (i = 0; i < len; /*nothing*/) {

- ND_TCHECK_1(buf + i);

ND_PRINT("%02X ", GET_U_1(buf + i) & 0xff);

i++;

if (i%8 == 0)

ND_PRINT("%02X ", GET_U_1(buf + i) & 0xff);

i++;

if (i%8 == 0)

@@ -320,7 +315,7 @@ smb_data_print(netdissect_options *ndo, const u_char *buf, u_int len)

while (n--)

ND_PRINT(" ");

while (n--)

ND_PRINT(" ");

- n = min(8, i % 16);

+ n = ND_MIN(8, i % 16);

print_asc(ndo, buf + i - (i % 16), n);

ND_PRINT(" ");

n = (i % 16) - n;

print_asc(ndo, buf + i - (i % 16), n);

ND_PRINT(" ");

n = (i % 16) - n;

@@ -328,10 +323,6 @@ smb_data_print(netdissect_options *ndo, const u_char *buf, u_int len)

print_asc(ndo, buf + i - n, n);

ND_PRINT("\n");

}

print_asc(ndo, buf + i - n, n);

ND_PRINT("\n");

}

- return;

-trunc:

- nd_print_trunc(ndo);

}

@@ -380,7 +371,6 @@ unistr(netdissect_options *ndo, char (*buf)[MAX_UNISTR_SIZE+1],

sp = s;

if (!use_unicode) {

for (;;) {

sp = s;

if (!use_unicode) {

for (;;) {

- ND_TCHECK_1(sp);

c = GET_U_1(sp);

sp++;

strsize++;

c = GET_U_1(sp);

sp++;

strsize++;

@@ -389,7 +379,6 @@ unistr(netdissect_options *ndo, char (*buf)[MAX_UNISTR_SIZE+1],

}

} else {

for (;;) {

}

} else {

for (;;) {

- ND_TCHECK_2(sp);

c = GET_LE_U_2(sp);

sp += 2;

strsize += 2;

c = GET_LE_U_2(sp);

sp += 2;

strsize += 2;

@@ -400,7 +389,6 @@ unistr(netdissect_options *ndo, char (*buf)[MAX_UNISTR_SIZE+1],

}

if (!use_unicode) {

while (strsize != 0) {

}

if (!use_unicode) {

while (strsize != 0) {

- ND_TCHECK_1(s);

c = GET_U_1(s);

s++;

strsize--;

c = GET_U_1(s);

s++;

strsize--;

@@ -432,7 +420,6 @@ unistr(netdissect_options *ndo, char (*buf)[MAX_UNISTR_SIZE+1],

}

} else {

while (strsize > 1) {

}

} else {

while (strsize > 1) {

- ND_TCHECK_2(s);

c = GET_LE_U_2(s);

s += 2;

strsize -= 2;

c = GET_LE_U_2(s);

s += 2;

strsize -= 2;

@@ -488,14 +475,12 @@ smb_fdata1(netdissect_options *ndo,

while (*fmt && buf<maxbuf) {

switch (*fmt) {

case 'a':

while (*fmt && buf<maxbuf) {

switch (*fmt) {

case 'a':

- ND_TCHECK_1(buf);

write_bits(ndo, GET_U_1(buf), attrib_fmt);

buf++;

fmt++;

break;

case 'A':

write_bits(ndo, GET_U_1(buf), attrib_fmt);

buf++;

fmt++;

break;

case 'A':

- ND_TCHECK_2(buf);

write_bits(ndo, GET_LE_U_2(buf), attrib_fmt);

buf += 2;

fmt++;

write_bits(ndo, GET_LE_U_2(buf), attrib_fmt);

buf += 2;

fmt++;

@@ -516,7 +501,6 @@ smb_fdata1(netdissect_options *ndo,

strncpy(bitfmt, fmt, l);

bitfmt[l] = '\0';

fmt = p + 1;

strncpy(bitfmt, fmt, l);

bitfmt[l] = '\0';

fmt = p + 1;

- ND_TCHECK_1(buf);

write_bits(ndo, GET_U_1(buf), bitfmt);

buf++;

break;

write_bits(ndo, GET_U_1(buf), bitfmt);

buf++;

break;

@@ -539,7 +523,6 @@ smb_fdata1(netdissect_options *ndo,

case 'b':

{

unsigned int x;

case 'b':

{

unsigned int x;

- ND_TCHECK_1(buf);

x = GET_U_1(buf);

ND_PRINT("%u (0x%x)", x, x);

buf += 1;

x = GET_U_1(buf);

ND_PRINT("%u (0x%x)", x, x);

buf += 1;

@@ -549,7 +532,6 @@ smb_fdata1(netdissect_options *ndo,

case 'd':

{

int x;

case 'd':

{

int x;

- ND_TCHECK_2(buf);

x = reverse ? GET_BE_S_2(buf) :

GET_LE_S_2(buf);

ND_PRINT("%d (0x%x)", x, x);

x = reverse ? GET_BE_S_2(buf) :

GET_LE_S_2(buf);

ND_PRINT("%d (0x%x)", x, x);

@@ -560,7 +542,6 @@ smb_fdata1(netdissect_options *ndo,

case 'D':

{

int x;

case 'D':

{

int x;

- ND_TCHECK_4(buf);

x = reverse ? GET_BE_S_4(buf) :

GET_LE_S_4(buf);

ND_PRINT("%d (0x%x)", x, x);

x = reverse ? GET_BE_S_4(buf) :

GET_LE_S_4(buf);

ND_PRINT("%d (0x%x)", x, x);

@@ -571,7 +552,6 @@ smb_fdata1(netdissect_options *ndo,

case 'L':

{

uint64_t x;

case 'L':

{

uint64_t x;

- ND_TCHECK_8(buf);

x = reverse ? GET_BE_U_8(buf) :

GET_LE_U_8(buf);

ND_PRINT("%" PRIu64 " (0x%" PRIx64 ")", x, x);

x = reverse ? GET_BE_U_8(buf) :

GET_LE_U_8(buf);

ND_PRINT("%" PRIu64 " (0x%" PRIx64 ")", x, x);

@@ -582,7 +562,6 @@ smb_fdata1(netdissect_options *ndo,

case 'u':

{

unsigned int x;

case 'u':

{

unsigned int x;

- ND_TCHECK_2(buf);

x = reverse ? GET_BE_U_2(buf) :

GET_LE_U_2(buf);

ND_PRINT("%u (0x%x)", x, x);

x = reverse ? GET_BE_U_2(buf) :

GET_LE_U_2(buf);

ND_PRINT("%u (0x%x)", x, x);

@@ -593,7 +572,6 @@ smb_fdata1(netdissect_options *ndo,

case 'U':

{

unsigned int x;

case 'U':

{

unsigned int x;

- ND_TCHECK_4(buf);

x = reverse ? GET_BE_U_4(buf) :

GET_LE_U_4(buf);

ND_PRINT("%u (0x%x)", x, x);

x = reverse ? GET_BE_U_4(buf) :

GET_LE_U_4(buf);

ND_PRINT("%u (0x%x)", x, x);

@@ -620,7 +598,6 @@ smb_fdata1(netdissect_options *ndo,

case 'B':

{

unsigned int x;

case 'B':

{

unsigned int x;

- ND_TCHECK_1(buf);

x = GET_U_1(buf);

ND_PRINT("0x%X", x);

buf += 1;

x = GET_U_1(buf);

ND_PRINT("0x%X", x);

buf += 1;

@@ -630,7 +607,6 @@ smb_fdata1(netdissect_options *ndo,

case 'w':

{

unsigned int x;

case 'w':

{

unsigned int x;

- ND_TCHECK_2(buf);

x = reverse ? GET_BE_U_2(buf) :

GET_LE_U_2(buf);

ND_PRINT("0x%X", x);

x = reverse ? GET_BE_U_2(buf) :

GET_LE_U_2(buf);

ND_PRINT("0x%X", x);

@@ -641,7 +617,6 @@ smb_fdata1(netdissect_options *ndo,

case 'W':

{

unsigned int x;

case 'W':

{

unsigned int x;

- ND_TCHECK_4(buf);

x = reverse ? GET_BE_U_4(buf) :

GET_LE_U_4(buf);

ND_PRINT("0x%X", x);

x = reverse ? GET_BE_U_4(buf) :

GET_LE_U_4(buf);

ND_PRINT("0x%X", x);

@@ -655,7 +630,6 @@ smb_fdata1(netdissect_options *ndo,

switch (*fmt) {

case 'b':

switch (*fmt) {

case 'b':

- ND_TCHECK_1(buf);

stringlen = GET_U_1(buf);

stringlen_is_set = 1;

ND_PRINT("%u", stringlen);

stringlen = GET_U_1(buf);

stringlen_is_set = 1;

ND_PRINT("%u", stringlen);

@@ -664,7 +638,6 @@ smb_fdata1(netdissect_options *ndo,

case 'd':

case 'u':

case 'd':

case 'u':

- ND_TCHECK_2(buf);

stringlen = reverse ? GET_BE_U_2(buf) :

GET_LE_U_2(buf);

stringlen_is_set = 1;

stringlen = reverse ? GET_BE_U_2(buf) :

GET_LE_U_2(buf);

stringlen_is_set = 1;

@@ -674,7 +647,6 @@ smb_fdata1(netdissect_options *ndo,

case 'D':

case 'U':

case 'D':

case 'U':

- ND_TCHECK_4(buf);

stringlen = reverse ? GET_BE_U_4(buf) :

GET_LE_U_4(buf);

stringlen_is_set = 1;

stringlen = reverse ? GET_BE_U_4(buf) :

GET_LE_U_4(buf);

stringlen_is_set = 1;

@@ -699,7 +671,6 @@ smb_fdata1(netdissect_options *ndo,

case 'Z':

case 'Y': /* like 'Z', but always ASCII */

{

case 'Z':

case 'Y': /* like 'Z', but always ASCII */

{

- ND_TCHECK_1(buf);

if (GET_U_1(buf) != 4 && GET_U_1(buf) != 2) {

ND_PRINT("Error! ASCIIZ buffer of type %u", GET_U_1(buf));

return maxbuf; /* give up */

if (GET_U_1(buf) != 4 && GET_U_1(buf) != 2) {

ND_PRINT("Error! ASCIIZ buffer of type %u", GET_U_1(buf));

return maxbuf; /* give up */

@@ -783,7 +754,6 @@ smb_fdata1(netdissect_options *ndo,

name_type_str(name_type));

break;

case 2:

name_type_str(name_type));

break;

case 2:

- ND_TCHECK_1(buf + 15);

name_type = GET_U_1(buf + 15);

ND_PRINT("%-15.15s NameType=0x%02X (%s)", buf, name_type,

name_type_str(name_type));

name_type = GET_U_1(buf + 15);

ND_PRINT("%-15.15s NameType=0x%02X (%s)", buf, name_type,

name_type_str(name_type));

@@ -798,13 +768,12 @@ smb_fdata1(netdissect_options *ndo,

case 'T':

{

time_t t;

case 'T':

{

time_t t;

- struct tm *lt;

const char *tstring;

+ char buffer[sizeof("Www Mmm dd hh:mm:ss yyyyy")];

uint32_t x;

switch (atoi(fmt + 1)) {

case 1:

uint32_t x;

switch (atoi(fmt + 1)) {

case 1:

- ND_TCHECK_4(buf);

x = GET_LE_U_4(buf);

if (x == 0 || x == 0xFFFFFFFF)

t = 0;

x = GET_LE_U_4(buf);

if (x == 0 || x == 0xFFFFFFFF)

t = 0;

@@ -813,7 +782,6 @@ smb_fdata1(netdissect_options *ndo,

buf += 4;

break;

case 2:

buf += 4;

break;

case 2:

- ND_TCHECK_4(buf);

x = GET_LE_U_4(buf);

if (x == 0 || x == 0xFFFFFFFF)

t = 0;

x = GET_LE_U_4(buf);

if (x == 0 || x == 0xFFFFFFFF)

t = 0;

@@ -831,14 +799,11 @@ smb_fdata1(netdissect_options *ndo,

break;

}

if (t != 0) {

break;

}

if (t != 0) {

- lt = localtime(&t);

- if (lt != NULL)

- tstring = asctime(lt);

- else

- tstring = "(Can't convert time)\n";

+ tstring = nd_format_time(buffer, sizeof(buffer), "%a %b %e %T %Y",

+ localtime(&t));

} else

- tstring = "NULL\n";

- ND_PRINT("%s", tstring);

+ tstring = "NULL";

+ ND_PRINT("%s\n", tstring);

fmt++;

while (ND_ASCII_ISDIGIT(*fmt))

fmt++;

while (ND_ASCII_ISDIGIT(*fmt))

fmt++;

@@ -873,11 +838,26 @@ smb_fdata(netdissect_options *ndo,

while (*fmt) {

switch (*fmt) {

case '*':

while (*fmt) {

switch (*fmt) {

case '*':

+ /*

+ * List of multiple instances of something described by the

+ * remainder of the string (which may itself include a list

+ * of multiple instances of something, so we recurse).

+ */

fmt++;

while (buf < maxbuf) {

const u_char *buf2;

depth++;

fmt++;

while (buf < maxbuf) {

const u_char *buf2;

depth++;

- buf2 = smb_fdata(ndo, buf, fmt, maxbuf, unicodestr);

+ /*

+ * In order to avoid stack exhaustion recurse at most 10

+ * levels; that "should not happen", as no SMB structure

+ * should be nested *that* deeply, and we thus shouldn't

+ * have format strings with that level of nesting.

+ */

+ if (depth == 10) {

+ ND_PRINT("(too many nested levels, not recursing)");

+ buf2 = buf;

+ } else

+ buf2 = smb_fdata(ndo, buf, fmt, maxbuf, unicodestr);

depth--;

if (buf2 == NULL)

return(NULL);

depth--;

if (buf2 == NULL)

return(NULL);

@@ -888,22 +868,35 @@ smb_fdata(netdissect_options *ndo,

return(buf);

case '|':

return(buf);

case '|':

+ /*

+ * Just do a bounds check.

+ */

fmt++;

if (buf >= maxbuf)

return(buf);

break;

case '%':

fmt++;

if (buf >= maxbuf)

return(buf);

break;

case '%':

+ /*

+ * XXX - unused?

+ */

fmt++;

buf = maxbuf;

break;

case '#':

fmt++;

buf = maxbuf;

break;

case '#':

+ /*

+ * Done?

+ */

fmt++;

return(buf);

break;

case '[':

fmt++;

return(buf);

break;

case '[':

+ /*

+ * Format of an item, enclosed in square brackets; dissect

+ * the item with smb_fdata1().

+ */

fmt++;

if (buf >= maxbuf)

return(buf);

fmt++;

if (buf >= maxbuf)

return(buf);

@@ -931,6 +924,9 @@ smb_fdata(netdissect_options *ndo,

break;

default:

break;

default:

+ /*

+ * Not a formatting character, so just print it.

+ */

ND_PRINT("%c", *fmt);

fmt++;

break;

ND_PRINT("%c", *fmt);

fmt++;

break;