X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/1ed63b5d0630a4b5b4a8d31174d9f3e95a970913..4c683712d4b483b43f16d41d09ec6232cbc917ca:/smbutil.c

diff --git a/smbutil.c b/smbutil.c
index 63a36860..fa5e133f 100644
--- a/smbutil.c
+++ b/smbutil.c
@@ -6,9 +6,7 @@
  * or later
  */
 
-#ifdef HAVE_CONFIG_H
 #include <config.h>
-#endif
 
 #include "netdissect-stdinc.h"
 
@@ -16,6 +14,8 @@
 #include <stdlib.h>
 #include <string.h>
 
+#include "netdissect-ctype.h"
+
 #include "netdissect.h"
 #include "extract.h"
 #include "smb.h"
@@ -143,7 +143,6 @@ name_interpret(netdissect_options *ndo,
 
     if (in >= maxbuf)
 	return(-1);	/* name goes past the end of the buffer */
-    ND_TCHECK_1(in);
     len = GET_U_1(in) / 2;
     in++;
 
@@ -188,7 +187,6 @@ name_ptr(netdissect_options *ndo,
     p = buf + ofs;
     if (p >= maxbuf)
 	return(NULL);	/* name goes past the end of the buffer */
-    ND_TCHECK_1(p);
 
     c = GET_U_1(p);
 
@@ -242,18 +240,16 @@ name_len(netdissect_options *ndo,
 
     if (s >= maxbuf)
 	return(-1);	/* name goes past the end of the buffer */
-    ND_TCHECK_1(s);
     c = GET_U_1(s);
     if ((c & 0xC0) == 0xC0)
 	return(2);
     while (GET_U_1(s)) {
 	if (s >= maxbuf)
 	    return(-1);	/* name goes past the end of the buffer */
-	ND_TCHECK_1(s);
 	s += GET_U_1(s) + 1;
 	ND_TCHECK_1(s);
     }
-    return(ND_BYTES_BETWEEN(s, s0) + 1);
+    return(ND_BYTES_BETWEEN(s0, s) + 1);
 
 trunc:
     return(-1);	/* name goes past the end of the buffer */
@@ -294,7 +290,6 @@ smb_data_print(netdissect_options *ndo, const u_char *buf, u_int len)
 	return;
     ND_PRINT("[%03X] ", i);
     for (i = 0; i < len; /*nothing*/) {
-        ND_TCHECK_1(buf + i);
 	ND_PRINT("%02X ", GET_U_1(buf + i) & 0xff);
 	i++;
 	if (i%8 == 0)
@@ -318,7 +313,7 @@ smb_data_print(netdissect_options *ndo, const u_char *buf, u_int len)
 	while (n--)
 	    ND_PRINT("   ");
 
-	n = min(8, i % 16);
+	n = ND_MIN(8, i % 16);
 	print_asc(ndo, buf + i - (i % 16), n);
 	ND_PRINT(" ");
 	n = (i % 16) - n;
@@ -326,10 +321,6 @@ smb_data_print(netdissect_options *ndo, const u_char *buf, u_int len)
 	    print_asc(ndo, buf + i - n, n);
 	ND_PRINT("\n");
     }
-    return;
-
-trunc:
-    nd_print_trunc(ndo);
 }
 
 
@@ -341,7 +332,7 @@ write_bits(netdissect_options *ndo,
     u_int i = 0;
 
     while ((p = strchr(fmt, '|'))) {
-	u_int l = ND_BYTES_BETWEEN(p, fmt);
+	u_int l = ND_BYTES_BETWEEN(fmt, p);
 	if (l && (val & (1 << i)))
 	    ND_PRINT("%.*s ", (int)l, fmt);
 	fmt = p + 1;
@@ -378,7 +369,6 @@ unistr(netdissect_options *ndo, char (*buf)[MAX_UNISTR_SIZE+1],
 	sp = s;
 	if (!use_unicode) {
 	    for (;;) {
-		ND_TCHECK_1(sp);
 		c = GET_U_1(sp);
 		sp++;
 		strsize++;
@@ -387,7 +377,6 @@ unistr(netdissect_options *ndo, char (*buf)[MAX_UNISTR_SIZE+1],
 	    }
 	} else {
 	    for (;;) {
-		ND_TCHECK_2(sp);
 		c = GET_LE_U_2(sp);
 		sp += 2;
 		strsize += 2;
@@ -397,8 +386,7 @@ unistr(netdissect_options *ndo, char (*buf)[MAX_UNISTR_SIZE+1],
 	}
     }
     if (!use_unicode) {
-    	while (strsize != 0) {
-	    ND_TCHECK_1(s);
+	while (strsize != 0) {
 	    c = GET_U_1(s);
 	    s++;
 	    strsize--;
@@ -418,9 +406,9 @@ unistr(netdissect_options *ndo, char (*buf)[MAX_UNISTR_SIZE+1],
 		break;
 	    }
 	    if (l < MAX_UNISTR_SIZE) {
-		if (ND_ISPRINT(c)) {
+		if (ND_ASCII_ISPRINT(c)) {
 		    /* It's a printable ASCII character */
-		    (*buf)[l] = c;
+		    (*buf)[l] = (char)c;
 		} else {
 		    /* It's a non-ASCII character or a non-printable ASCII character */
 		    (*buf)[l] = '.';
@@ -430,7 +418,6 @@ unistr(netdissect_options *ndo, char (*buf)[MAX_UNISTR_SIZE+1],
 	}
     } else {
 	while (strsize > 1) {
-	    ND_TCHECK_2(s);
 	    c = GET_LE_U_2(s);
 	    s += 2;
 	    strsize -= 2;
@@ -450,9 +437,9 @@ unistr(netdissect_options *ndo, char (*buf)[MAX_UNISTR_SIZE+1],
 		break;
 	    }
 	    if (l < MAX_UNISTR_SIZE) {
-		if (ND_ISPRINT(c)) {
+		if (ND_ASCII_ISPRINT(c)) {
 		    /* It's a printable ASCII character */
-		    (*buf)[l] = c;
+		    (*buf)[l] = (char)c;
 		} else {
 		    /* It's a non-ASCII character or a non-printable ASCII character */
 		    (*buf)[l] = '.';
@@ -486,14 +473,12 @@ smb_fdata1(netdissect_options *ndo,
     while (*fmt && buf<maxbuf) {
 	switch (*fmt) {
 	case 'a':
-	    ND_TCHECK_1(buf);
 	    write_bits(ndo, GET_U_1(buf), attrib_fmt);
 	    buf++;
 	    fmt++;
 	    break;
 
 	case 'A':
-	    ND_TCHECK_2(buf);
 	    write_bits(ndo, GET_LE_U_2(buf), attrib_fmt);
 	    buf += 2;
 	    fmt++;
@@ -506,7 +491,7 @@ smb_fdata1(netdissect_options *ndo,
 	    u_int l;
 
 	    p = strchr(++fmt, '}');
-	    l = ND_BYTES_BETWEEN(p, fmt);
+	    l = ND_BYTES_BETWEEN(fmt, p);
 
 	    if (l > sizeof(bitfmt) - 1)
 		l = sizeof(bitfmt)-1;
@@ -514,7 +499,6 @@ smb_fdata1(netdissect_options *ndo,
 	    strncpy(bitfmt, fmt, l);
 	    bitfmt[l] = '\0';
 	    fmt = p + 1;
-	    ND_TCHECK_1(buf);
 	    write_bits(ndo, GET_U_1(buf), bitfmt);
 	    buf++;
 	    break;
@@ -526,7 +510,7 @@ smb_fdata1(netdissect_options *ndo,
 	    ND_TCHECK_LEN(buf, l);
 	    buf += l;
 	    fmt++;
-	    while (isdigit((unsigned char)*fmt))
+	    while (ND_ASCII_ISDIGIT(*fmt))
 		fmt++;
 	    break;
 	  }
@@ -537,7 +521,6 @@ smb_fdata1(netdissect_options *ndo,
 	case 'b':
 	  {
 	    unsigned int x;
-	    ND_TCHECK_1(buf);
 	    x = GET_U_1(buf);
 	    ND_PRINT("%u (0x%x)", x, x);
 	    buf += 1;
@@ -547,7 +530,6 @@ smb_fdata1(netdissect_options *ndo,
 	case 'd':
 	  {
 	    int x;
-	    ND_TCHECK_2(buf);
 	    x = reverse ? GET_BE_S_2(buf) :
 			  GET_LE_S_2(buf);
 	    ND_PRINT("%d (0x%x)", x, x);
@@ -558,7 +540,6 @@ smb_fdata1(netdissect_options *ndo,
 	case 'D':
 	  {
 	    int x;
-	    ND_TCHECK_4(buf);
 	    x = reverse ? GET_BE_S_4(buf) :
 			  GET_LE_S_4(buf);
 	    ND_PRINT("%d (0x%x)", x, x);
@@ -569,7 +550,6 @@ smb_fdata1(netdissect_options *ndo,
 	case 'L':
 	  {
 	    uint64_t x;
-	    ND_TCHECK_8(buf);
 	    x = reverse ? GET_BE_U_8(buf) :
 			  GET_LE_U_8(buf);
 	    ND_PRINT("%" PRIu64 " (0x%" PRIx64 ")", x, x);
@@ -580,7 +560,6 @@ smb_fdata1(netdissect_options *ndo,
 	case 'u':
 	  {
 	    unsigned int x;
-	    ND_TCHECK_2(buf);
 	    x = reverse ? GET_BE_U_2(buf) :
 			  GET_LE_U_2(buf);
 	    ND_PRINT("%u (0x%x)", x, x);
@@ -591,7 +570,6 @@ smb_fdata1(netdissect_options *ndo,
 	case 'U':
 	  {
 	    unsigned int x;
-	    ND_TCHECK_4(buf);
 	    x = reverse ? GET_BE_U_4(buf) :
 			  GET_LE_U_4(buf);
 	    ND_PRINT("%u (0x%x)", x, x);
@@ -618,7 +596,6 @@ smb_fdata1(netdissect_options *ndo,
 	case 'B':
 	  {
 	    unsigned int x;
-	    ND_TCHECK_1(buf);
 	    x = GET_U_1(buf);
 	    ND_PRINT("0x%X", x);
 	    buf += 1;
@@ -628,7 +605,6 @@ smb_fdata1(netdissect_options *ndo,
 	case 'w':
 	  {
 	    unsigned int x;
-	    ND_TCHECK_2(buf);
 	    x = reverse ? GET_BE_U_2(buf) :
 			  GET_LE_U_2(buf);
 	    ND_PRINT("0x%X", x);
@@ -639,7 +615,6 @@ smb_fdata1(netdissect_options *ndo,
 	case 'W':
 	  {
 	    unsigned int x;
-	    ND_TCHECK_4(buf);
 	    x = reverse ? GET_BE_U_4(buf) :
 			  GET_LE_U_4(buf);
 	    ND_PRINT("0x%X", x);
@@ -653,7 +628,6 @@ smb_fdata1(netdissect_options *ndo,
 	    switch (*fmt) {
 
 	    case 'b':
-		ND_TCHECK_1(buf);
 		stringlen = GET_U_1(buf);
 		stringlen_is_set = 1;
 		ND_PRINT("%u", stringlen);
@@ -662,7 +636,6 @@ smb_fdata1(netdissect_options *ndo,
 
 	    case 'd':
 	    case 'u':
-		ND_TCHECK_2(buf);
 		stringlen = reverse ? GET_BE_U_2(buf) :
 				      GET_LE_U_2(buf);
 		stringlen_is_set = 1;
@@ -672,7 +645,6 @@ smb_fdata1(netdissect_options *ndo,
 
 	    case 'D':
 	    case 'U':
-		ND_TCHECK_4(buf);
 		stringlen = reverse ? GET_BE_U_4(buf) :
 				      GET_LE_U_4(buf);
 		stringlen_is_set = 1;
@@ -697,7 +669,6 @@ smb_fdata1(netdissect_options *ndo,
 	case 'Z':
 	case 'Y':	/* like 'Z', but always ASCII */
 	  {
-	    ND_TCHECK_1(buf);
 	    if (GET_U_1(buf) != 4 && GET_U_1(buf) != 2) {
 		ND_PRINT("Error! ASCIIZ buffer of type %u", GET_U_1(buf));
 		return maxbuf;	/* give up */
@@ -716,7 +687,7 @@ smb_fdata1(netdissect_options *ndo,
 	    ND_PRINT("%-*.*s", l, l, buf);
 	    buf += l;
 	    fmt++;
-	    while (isdigit((unsigned char)*fmt))
+	    while (ND_ASCII_ISDIGIT(*fmt))
 		fmt++;
 	    break;
 	  }
@@ -730,7 +701,7 @@ smb_fdata1(netdissect_options *ndo,
 	    ND_PRINT("%-*.*s", (int)stringlen, (int)stringlen, buf);
 	    buf += stringlen;
 	    fmt++;
-	    while (isdigit((unsigned char)*fmt))
+	    while (ND_ASCII_ISDIGIT(*fmt))
 		fmt++;
 	    break;
 	  }
@@ -756,7 +727,7 @@ smb_fdata1(netdissect_options *ndo,
 		buf++;
 	    }
 	    fmt++;
-	    while (isdigit((unsigned char)*fmt))
+	    while (ND_ASCII_ISDIGIT(*fmt))
 		fmt++;
 	    break;
 	  }
@@ -769,8 +740,9 @@ smb_fdata1(netdissect_options *ndo,
 
 	    switch (t) {
 	    case 1:
-		name_type = name_extract(ndo, startbuf, ND_BYTES_BETWEEN(buf, startbuf),
-		    maxbuf, nbuf);
+		name_type = name_extract(ndo, startbuf,
+                                         ND_BYTES_BETWEEN(startbuf, buf),
+                                         maxbuf, nbuf);
 		if (name_type < 0)
 		    goto trunc;
 		len = name_len(ndo, buf, maxbuf);
@@ -781,7 +753,6 @@ smb_fdata1(netdissect_options *ndo,
 		    name_type_str(name_type));
 		break;
 	    case 2:
-		ND_TCHECK_1(buf + 15);
 		name_type = GET_U_1(buf + 15);
 		ND_PRINT("%-15.15s NameType=0x%02X (%s)", buf, name_type,
 		    name_type_str(name_type));
@@ -789,20 +760,19 @@ smb_fdata1(netdissect_options *ndo,
 		break;
 	    }
 	    fmt++;
-	    while (isdigit((unsigned char)*fmt))
+	    while (ND_ASCII_ISDIGIT(*fmt))
 		fmt++;
 	    break;
 	  }
 	case 'T':
 	  {
 	    time_t t;
-	    struct tm *lt;
 	    const char *tstring;
+	    char buffer[sizeof("Www Mmm dd hh:mm:ss yyyyy")];
 	    uint32_t x;
 
 	    switch (atoi(fmt + 1)) {
 	    case 1:
-		ND_TCHECK_4(buf);
 		x = GET_LE_U_4(buf);
 		if (x == 0 || x == 0xFFFFFFFF)
 		    t = 0;
@@ -811,7 +781,6 @@ smb_fdata1(netdissect_options *ndo,
 		buf += 4;
 		break;
 	    case 2:
-		ND_TCHECK_4(buf);
 		x = GET_LE_U_4(buf);
 		if (x == 0 || x == 0xFFFFFFFF)
 		    t = 0;
@@ -829,16 +798,13 @@ smb_fdata1(netdissect_options *ndo,
 		break;
 	    }
 	    if (t != 0) {
-		lt = localtime(&t);
-		if (lt != NULL)
-		    tstring = asctime(lt);
-		else
-		    tstring = "(Can't convert time)\n";
+		tstring = nd_format_time(buffer, sizeof(buffer), "%Y-%m-%d %T",
+					 localtime(&t));
 	    } else
-		tstring = "NULL\n";
-	    ND_PRINT("%s", tstring);
+		tstring = "NULL";
+	    ND_PRINT("%s\n", tstring);
 	    fmt++;
-	    while (isdigit((unsigned char)*fmt))
+	    while (ND_ASCII_ISDIGIT(*fmt))
 		fmt++;
 	    break;
 	  }
@@ -871,11 +837,26 @@ smb_fdata(netdissect_options *ndo,
     while (*fmt) {
 	switch (*fmt) {
 	case '*':
+	    /*
+	     * List of multiple instances of something described by the
+	     * remainder of the string (which may itself include a list
+	     * of multiple instances of something, so we recurse).
+	     */
 	    fmt++;
 	    while (buf < maxbuf) {
 		const u_char *buf2;
 		depth++;
-		buf2 = smb_fdata(ndo, buf, fmt, maxbuf, unicodestr);
+		/*
+		 * In order to avoid stack exhaustion recurse at most 10
+		 * levels; that "should not happen", as no SMB structure
+		 * should be nested *that* deeply, and we thus shouldn't
+		 * have format strings with that level of nesting.
+		 */
+		if (depth == 10) {
+			ND_PRINT("(too many nested levels, not recursing)");
+			buf2 = buf;
+		} else
+			buf2 = smb_fdata(ndo, buf, fmt, maxbuf, unicodestr);
 		depth--;
 		if (buf2 == NULL)
 		    return(NULL);
@@ -886,22 +867,35 @@ smb_fdata(netdissect_options *ndo,
 	    return(buf);
 
 	case '|':
+	    /*
+	     * Just do a bounds check.
+	     */
 	    fmt++;
 	    if (buf >= maxbuf)
 		return(buf);
 	    break;
 
 	case '%':
+	    /*
+	     * XXX - unused?
+	     */
 	    fmt++;
 	    buf = maxbuf;
 	    break;
 
 	case '#':
+	    /*
+	     * Done?
+	     */
 	    fmt++;
 	    return(buf);
 	    break;
 
 	case '[':
+	    /*
+	     * Format of an item, enclosed in square brackets; dissect
+	     * the item with smb_fdata1().
+	     */
 	    fmt++;
 	    if (buf >= maxbuf)
 		return(buf);
@@ -929,13 +923,16 @@ smb_fdata(netdissect_options *ndo,
 	    break;
 
 	default:
+	    /*
+	     * Not a formatting character, so just print it.
+	     */
 	    ND_PRINT("%c", *fmt);
 	    fmt++;
 	    break;
 	}
     }
     if (!depth && buf < maxbuf) {
-	u_int len = ND_BYTES_BETWEEN(maxbuf, buf);
+	u_int len = ND_BYTES_BETWEEN(buf, maxbuf);
 	ND_PRINT("Data: (%u bytes)\n", len);
 	smb_data_print(ndo, buf, len);
 	return(buf + len);