Bug Summary

File:builds/wireshark/wireshark/epan/reassemble.c
Warning:line 1909, column 12
Potential leak of memory pointed to by 'data'

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name reassemble.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -fno-delete-null-pointer-checks -mframe-pointer=all -relaxed-aliasing -fmath-errno -ffp-contract=on -fno-rounding-math -ffloat16-excess-precision=fast -fbfloat16-excess-precision=fast -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/builds/wireshark/wireshark/build -fcoverage-compilation-dir=/builds/wireshark/wireshark/build -resource-dir /usr/lib/llvm-18/lib/clang/18 -isystem /usr/include/glib-2.0 -isystem /usr/lib/x86_64-linux-gnu/glib-2.0/include -isystem /builds/wireshark/wireshark/epan -isystem /builds/wireshark/wireshark/build/epan -isystem /usr/include/libxml2 -isystem /usr/include/lua5.4 -D G_DISABLE_DEPRECATED -D G_DISABLE_SINGLE_INCLUDES -D WS_BUILD_DLL -D WS_DEBUG -D WS_DEBUG_UTF_8 -D epan_EXPORTS -I /builds/wireshark/wireshark/build -I /builds/wireshark/wireshark -I /builds/wireshark/wireshark/include -I /builds/wireshark/wireshark/wiretap -D _GLIBCXX_ASSERTIONS -internal-isystem /usr/lib/llvm-18/lib/clang/18/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fmacro-prefix-map=/builds/wireshark/wireshark/= -fmacro-prefix-map=/builds/wireshark/wireshark/build/= -fmacro-prefix-map=../= -Wno-format-truncation -Wno-format-nonliteral -Wno-pointer-sign -std=gnu11 -ferror-limit 19 -fvisibility=hidden -fwrapv -fstrict-flex-arrays=3 -stack-protector 2 -fstack-clash-protection -fcf-protection=full -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fexceptions -fcolor-diagnostics -analyzer-output=html -dwarf-debug-flags /usr/lib/llvm-18/bin/clang -### --analyze -x c -D G_DISABLE_DEPRECATED -D G_DISABLE_SINGLE_INCLUDES -D WS_BUILD_DLL -D WS_DEBUG -D WS_DEBUG_UTF_8 -D epan_EXPORTS -I /builds/wireshark/wireshark/build -I /builds/wireshark/wireshark -I /builds/wireshark/wireshark/include -I /builds/wireshark/wireshark/wiretap -isystem /usr/include/glib-2.0 -isystem /usr/lib/x86_64-linux-gnu/glib-2.0/include -isystem /builds/wireshark/wireshark/epan -isystem /builds/wireshark/wireshark/build/epan -isystem /usr/include/libxml2 -isystem /usr/include/lua5.4 -fvisibility=hidden -fexcess-precision=fast -fstrict-flex-arrays=3 -fstack-clash-protection -fcf-protection=full -D _GLIBCXX_ASSERTIONS -fstack-protector-strong -fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing -fexceptions -Wno-format-truncation -Wno-format-nonliteral -fdiagnostics-color=always -Wno-pointer-sign -fmacro-prefix-map=/builds/wireshark/wireshark/= -fmacro-prefix-map=/builds/wireshark/wireshark/build/= -fmacro-prefix-map=../= -std=gnu11 -fPIC /builds/wireshark/wireshark/epan/reassemble.c -o /builds/wireshark/wireshark/sbout/2024-10-22-100333-3919-1 -Xclang -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /builds/wireshark/wireshark/sbout/2024-10-22-100333-3919-1 -x c /builds/wireshark/wireshark/epan/reassemble.c
1/* reassemble.c
2 * Routines for {fragment,segment} reassembly
3 *
4 * Wireshark - Network traffic analyzer
5 * By Gerald Combs <gerald@wireshark.org>
6 * Copyright 1998 Gerald Combs
7 *
8 * SPDX-License-Identifier: GPL-2.0-or-later
9 */
10
11#include "config.h"
12
13#include <string.h>
14
15#include <epan/packet.h>
16#include <epan/exceptions.h>
17#include <epan/reassemble.h>
18#include <epan/tvbuff-int.h>
19
20#include <wsutil/str_util.h>
21#include <wsutil/ws_assert.h>
22
23/*
24 * Functions for reassembly tables where the endpoint addresses, and a
25 * fragment ID, are used as the key.
26 */
27typedef struct _fragment_addresses_key {
28 address src;
29 address dst;
30 uint32_t id;
31} fragment_addresses_key;
32
33GList* reassembly_table_list;
34
35static unsigned
36fragment_addresses_hash(const void *k)
37{
38 const fragment_addresses_key* key = (const fragment_addresses_key*) k;
39 unsigned hash_val;
40/*
41 int i;
42*/
43
44 hash_val = 0;
45
46/* More than likely: in most captures src and dst addresses are the
47 same, and would hash the same.
48 We only use id as the hash as an optimization.
49
50 for (i = 0; i < key->src.len; i++)
51 hash_val += key->src.data[i];
52 for (i = 0; i < key->dst.len; i++)
53 hash_val += key->dst.data[i];
54*/
55
56 hash_val += key->id;
57
58 return hash_val;
59}
60
61static int
62fragment_addresses_equal(const void *k1, const void *k2)
63{
64 const fragment_addresses_key* key1 = (const fragment_addresses_key*) k1;
65 const fragment_addresses_key* key2 = (const fragment_addresses_key*) k2;
66
67 /*
68 * key.id is the first item to compare since it's the item most
69 * likely to differ between sessions, thus short-circuiting
70 * the comparison of addresses.
71 */
72 return (key1->id == key2->id) &&
73 (addresses_equal(&key1->src, &key2->src)) &&
74 (addresses_equal(&key1->dst, &key2->dst));
75}
76
77/*
78 * Create a fragment key for temporary use; it can point to non-
79 * persistent data, and so must only be used to look up and
80 * delete entries, not to add them.
81 */
82static void *
83fragment_addresses_temporary_key(const packet_info *pinfo, const uint32_t id,
84 const void *data _U___attribute__((unused)))
85{
86 fragment_addresses_key *key = g_slice_new(fragment_addresses_key)((fragment_addresses_key*) g_slice_alloc (sizeof (fragment_addresses_key
)))
;
87
88 /*
89 * Do a shallow copy of the addresses.
90 */
91 copy_address_shallow(&key->src, &pinfo->src);
92 copy_address_shallow(&key->dst, &pinfo->dst);
93 key->id = id;
94
95 return (void *)key;
96}
97
98/*
99 * Create a fragment key for permanent use; it must point to persistent
100 * data, so that it can be used to add entries.
101 */
102static void *
103fragment_addresses_persistent_key(const packet_info *pinfo, const uint32_t id,
104 const void *data _U___attribute__((unused)))
105{
106 fragment_addresses_key *key = g_slice_new(fragment_addresses_key)((fragment_addresses_key*) g_slice_alloc (sizeof (fragment_addresses_key
)))
;
107
108 /*
109 * Do a deep copy of the addresses.
110 */
111 copy_address(&key->src, &pinfo->src);
112 copy_address(&key->dst, &pinfo->dst);
113 key->id = id;
114
115 return (void *)key;
116}
117
118static void
119fragment_addresses_free_temporary_key(void *ptr)
120{
121 fragment_addresses_key *key = (fragment_addresses_key *)ptr;
122 g_slice_free(fragment_addresses_key, key)do { if (1) g_slice_free1 (sizeof (fragment_addresses_key), (
key)); else (void) ((fragment_addresses_key*) 0 == (key)); } while
(0)
;
123}
124
125static void
126fragment_addresses_free_persistent_key(void *ptr)
127{
128 fragment_addresses_key *key = (fragment_addresses_key *)ptr;
129
130 if(key){
131 /*
132 * Free up the copies of the addresses from the old key.
133 */
134 free_address(&key->src);
135 free_address(&key->dst);
136
137 g_slice_free(fragment_addresses_key, key)do { if (1) g_slice_free1 (sizeof (fragment_addresses_key), (
key)); else (void) ((fragment_addresses_key*) 0 == (key)); } while
(0)
;
138 }
139}
140
141const reassembly_table_functions
142addresses_reassembly_table_functions = {
143 fragment_addresses_hash,
144 fragment_addresses_equal,
145 fragment_addresses_temporary_key,
146 fragment_addresses_persistent_key,
147 fragment_addresses_free_temporary_key,
148 fragment_addresses_free_persistent_key
149};
150
151/*
152 * Functions for reassembly tables where the endpoint addresses and ports,
153 * and a fragment ID, are used as the key.
154 */
155typedef struct _fragment_addresses_ports_key {
156 address src_addr;
157 address dst_addr;
158 uint32_t src_port;
159 uint32_t dst_port;
160 uint32_t id;
161} fragment_addresses_ports_key;
162
163static unsigned
164fragment_addresses_ports_hash(const void *k)
165{
166 const fragment_addresses_ports_key* key = (const fragment_addresses_ports_key*) k;
167 unsigned hash_val;
168/*
169 int i;
170*/
171
172 hash_val = 0;
173
174/* More than likely: in most captures src and dst addresses and ports
175 are the same, and would hash the same.
176 We only use id as the hash as an optimization.
177
178 for (i = 0; i < key->src.len; i++)
179 hash_val += key->src_addr.data[i];
180 for (i = 0; i < key->dst.len; i++)
181 hash_val += key->dst_addr.data[i];
182 hash_val += key->src_port;
183 hash_val += key->dst_port;
184*/
185
186 hash_val += key->id;
187
188 return hash_val;
189}
190
191static int
192fragment_addresses_ports_equal(const void *k1, const void *k2)
193{
194 const fragment_addresses_ports_key* key1 = (const fragment_addresses_ports_key*) k1;
195 const fragment_addresses_ports_key* key2 = (const fragment_addresses_ports_key*) k2;
196
197 /*
198 * key.id is the first item to compare since it's the item most
199 * likely to differ between sessions, thus short-circuiting
200 * the comparison of addresses and ports.
201 */
202 return (key1->id == key2->id) &&
203 (addresses_equal(&key1->src_addr, &key2->src_addr)) &&
204 (addresses_equal(&key1->dst_addr, &key2->dst_addr)) &&
205 (key1->src_port == key2->src_port) &&
206 (key1->dst_port == key2->dst_port);
207}
208
209/*
210 * Create a fragment key for temporary use; it can point to non-
211 * persistent data, and so must only be used to look up and
212 * delete entries, not to add them.
213 */
214static void *
215fragment_addresses_ports_temporary_key(const packet_info *pinfo, const uint32_t id,
216 const void *data _U___attribute__((unused)))
217{
218 fragment_addresses_ports_key *key = g_slice_new(fragment_addresses_ports_key)((fragment_addresses_ports_key*) g_slice_alloc (sizeof (fragment_addresses_ports_key
)))
;
219
220 /*
221 * Do a shallow copy of the addresses.
222 */
223 copy_address_shallow(&key->src_addr, &pinfo->src);
224 copy_address_shallow(&key->dst_addr, &pinfo->dst);
225 key->src_port = pinfo->srcport;
226 key->dst_port = pinfo->destport;
227 key->id = id;
228
229 return (void *)key;
230}
231
232/*
233 * Create a fragment key for permanent use; it must point to persistent
234 * data, so that it can be used to add entries.
235 */
236static void *
237fragment_addresses_ports_persistent_key(const packet_info *pinfo,
238 const uint32_t id, const void *data _U___attribute__((unused)))
239{
240 fragment_addresses_ports_key *key = g_slice_new(fragment_addresses_ports_key)((fragment_addresses_ports_key*) g_slice_alloc (sizeof (fragment_addresses_ports_key
)))
;
241
242 /*
243 * Do a deep copy of the addresses.
244 */
245 copy_address(&key->src_addr, &pinfo->src);
246 copy_address(&key->dst_addr, &pinfo->dst);
247 key->src_port = pinfo->srcport;
248 key->dst_port = pinfo->destport;
249 key->id = id;
250
251 return (void *)key;
252}
253
254static void
255fragment_addresses_ports_free_temporary_key(void *ptr)
256{
257 fragment_addresses_ports_key *key = (fragment_addresses_ports_key *)ptr;
258 g_slice_free(fragment_addresses_ports_key, key)do { if (1) g_slice_free1 (sizeof (fragment_addresses_ports_key
), (key)); else (void) ((fragment_addresses_ports_key*) 0 == (
key)); } while (0)
;
259}
260
261static void
262fragment_addresses_ports_free_persistent_key(void *ptr)
263{
264 fragment_addresses_ports_key *key = (fragment_addresses_ports_key *)ptr;
265
266 if(key){
267 /*
268 * Free up the copies of the addresses from the old key.
269 */
270 free_address(&key->src_addr);
271 free_address(&key->dst_addr);
272
273 g_slice_free(fragment_addresses_ports_key, key)do { if (1) g_slice_free1 (sizeof (fragment_addresses_ports_key
), (key)); else (void) ((fragment_addresses_ports_key*) 0 == (
key)); } while (0)
;
274 }
275}
276
277const reassembly_table_functions
278addresses_ports_reassembly_table_functions = {
279 fragment_addresses_ports_hash,
280 fragment_addresses_ports_equal,
281 fragment_addresses_ports_temporary_key,
282 fragment_addresses_ports_persistent_key,
283 fragment_addresses_ports_free_temporary_key,
284 fragment_addresses_ports_free_persistent_key
285};
286
287typedef struct _reassembled_key {
288 uint32_t id;
289 uint32_t frame;
290} reassembled_key;
291
292static int
293reassembled_equal(const void *k1, const void *k2)
294{
295 const reassembled_key* key1 = (const reassembled_key*) k1;
296 const reassembled_key* key2 = (const reassembled_key*) k2;
297
298 /*
299 * We assume that the frame numbers are unlikely to be equal,
300 * so we check them first.
301 */
302 return key1->frame == key2->frame && key1->id == key2->id;
303}
304
305static unsigned
306reassembled_hash(const void *k)
307{
308 const reassembled_key* key = (const reassembled_key*) k;
309
310 return key->frame;
311}
312
313static void
314reassembled_key_free(void *ptr)
315{
316 g_slice_free(reassembled_key, (reassembled_key *)ptr)do { if (1) g_slice_free1 (sizeof (reassembled_key), ((reassembled_key
*)ptr)); else (void) ((reassembled_key*) 0 == ((reassembled_key
*)ptr)); } while (0)
;
317}
318
319/*
320 * For a fragment hash table entry, free the associated fragments.
321 * The entry value (fd_chain) is freed herein and the entry is freed
322 * when the key freeing routine is called (as a consequence of returning
323 * true from this function).
324 */
325static gboolean
326free_all_fragments(void *key_arg _U___attribute__((unused)), void *value, void *user_data _U___attribute__((unused)))
327{
328 fragment_head *fd_head;
329 fragment_item *fd_i = NULL((void*)0), *tmp_fd;
330
331 /* g_hash_table_new_full() was used to supply a function
332 * to free the key and anything to which it points
333 */
334 fd_head = (fragment_head *)value;
335 if (fd_head != NULL((void*)0)) {
336 fd_i = fd_head->next;
337 if(fd_head->tvb_data && !(fd_head->flags&FD_SUBSET_TVB0x0020))
338 tvb_free(fd_head->tvb_data);
339 g_slice_free(fragment_head, fd_head)do { if (1) g_slice_free1 (sizeof (fragment_head), (fd_head))
; else (void) ((fragment_head*) 0 == (fd_head)); } while (0)
;
340 }
341
342 for (; fd_i != NULL((void*)0); fd_i = tmp_fd) {
343 tmp_fd=fd_i->next;
344
345 if(fd_i->tvb_data && !(fd_i->flags&FD_SUBSET_TVB0x0020))
346 tvb_free(fd_i->tvb_data);
347 g_slice_free(fragment_item, fd_i)do { if (1) g_slice_free1 (sizeof (fragment_item), (fd_i)); else
(void) ((fragment_item*) 0 == (fd_i)); } while (0)
;
348 }
349
350 return TRUE(!(0));
351}
352
353/* ------------------------- */
354static fragment_head *new_head(const uint32_t flags)
355{
356 fragment_head *fd_head;
357 /* If head/first structure in list only holds no other data than
358 * 'datalen' then we don't have to change the head of the list
359 * even if we want to keep it sorted
360 */
361 fd_head=g_slice_new0(fragment_head)((fragment_head*) g_slice_alloc0 (sizeof (fragment_head)));
362
363 fd_head->flags=flags;
364 return fd_head;
365}
366
367/*
368 * For a reassembled-packet hash table entry, free the fragment data
369 * to which the value refers. (The key is freed by reassembled_key_free.)
370 */
371static void
372free_fd_head(fragment_head *fd_head)
373{
374 fragment_item *fd_i, *tmp;
375
376 if (fd_head->flags & FD_SUBSET_TVB0x0020)
377 fd_head->tvb_data = NULL((void*)0);
378 if (fd_head->tvb_data)
379 tvb_free(fd_head->tvb_data);
380 for (fd_i = fd_head->next; fd_i; fd_i = tmp) {
381 tmp = fd_i->next;
382 if (fd_i->flags & FD_SUBSET_TVB0x0020)
383 fd_i->tvb_data = NULL((void*)0);
384 if (fd_i->tvb_data) {
385 tvb_free(fd_i->tvb_data);
386 }
387 g_slice_free(fragment_item, fd_i)do { if (1) g_slice_free1 (sizeof (fragment_item), (fd_i)); else
(void) ((fragment_item*) 0 == (fd_i)); } while (0)
;
388 }
389 g_slice_free(fragment_head, fd_head)do { if (1) g_slice_free1 (sizeof (fragment_head), (fd_head))
; else (void) ((fragment_head*) 0 == (fd_head)); } while (0)
;
390}
391
392static void
393unref_fd_head(void *data)
394{
395 fragment_head *fd_head = (fragment_head *) data;
396 fd_head->ref_count--;
397
398 if (fd_head->ref_count == 0) {
399 free_fd_head(fd_head);
400 }
401}
402
403static void
404reassembled_table_insert(GHashTable *reassembled_table, reassembled_key *key, fragment_head *fd_head)
405{
406 fragment_head *old_fd_head;
407 fd_head->ref_count++;
408 if ((old_fd_head = g_hash_table_lookup(reassembled_table, key)) != NULL((void*)0)) {
409 if (old_fd_head->ref_count == 1) {
410 /* We're replacing the last entry in the reassembled
411 * table for an old reassembly. Does it have a tvb?
412 * We might still be using that tvb's memory for an
413 * address via set_address_tvb(). (See #19094.)
414 */
415 if (old_fd_head->tvb_data && fd_head->tvb_data) {
416 /* Free it when the new tvb is freed */
417 tvb_set_child_real_data_tvbuff(fd_head->tvb_data, old_fd_head->tvb_data);
418 }
419 /* XXX: Set the old data to NULL regardless. If we
420 * have old data but not new data, that is odd (we're
421 * replacing a reassembly with tvb data with something
422 * with no tvb data, possibly because a zero length or
423 * null tvb was passed into a defragment function,
424 * which is a dissector bug.)
425 * This leaks the tvb data if we couldn't add it to
426 * a new tvb's chain, but we might not be able to free
427 * it yet if set_address_tvb() was used.
428 */
429 old_fd_head->tvb_data = NULL((void*)0);
430 }
431 }
432 g_hash_table_insert(reassembled_table, key, fd_head);
433}
434
435typedef struct register_reassembly_table {
436 reassembly_table *table;
437 const reassembly_table_functions *funcs;
438} register_reassembly_table_t;
439
440/*
441 * Register a reassembly table.
442 */
443void
444reassembly_table_register(reassembly_table *table,
445 const reassembly_table_functions *funcs)
446{
447 register_reassembly_table_t* reg_table;
448
449 DISSECTOR_ASSERT(table)((void) ((table) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/reassemble.c", 449, "table"))))
;
450 DISSECTOR_ASSERT(funcs)((void) ((funcs) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/reassemble.c", 450, "funcs"))))
;
451
452 reg_table = g_new(register_reassembly_table_t,1)((register_reassembly_table_t *) g_malloc_n ((1), sizeof (register_reassembly_table_t
)))
;
453
454 reg_table->table = table;
455 reg_table->funcs = funcs;
456
457 reassembly_table_list = g_list_prepend(reassembly_table_list, reg_table);
458}
459
460/*
461 * Initialize a reassembly table, with specified functions.
462 */
463void
464reassembly_table_init(reassembly_table *table,
465 const reassembly_table_functions *funcs)
466{
467 if (table->temporary_key_func == NULL((void*)0))
468 table->temporary_key_func = funcs->temporary_key_func;
469 if (table->persistent_key_func == NULL((void*)0))
470 table->persistent_key_func = funcs->persistent_key_func;
471 if (table->free_temporary_key_func == NULL((void*)0))
472 table->free_temporary_key_func = funcs->free_temporary_key_func;
473 if (table->fragment_table != NULL((void*)0)) {
474 /*
475 * The fragment hash table exists.
476 *
477 * Remove all entries and free fragment data for each entry.
478 *
479 * The keys, and anything to which they point, are freed by
480 * calling the table's key freeing function. The values
481 * are freed in free_all_fragments().
482 */
483 g_hash_table_foreach_remove(table->fragment_table,
484 free_all_fragments, NULL((void*)0));
485 } else {
486 /* The fragment table does not exist. Create it */
487 table->fragment_table = g_hash_table_new_full(funcs->hash_func,
488 funcs->equal_func, funcs->free_persistent_key_func, NULL((void*)0));
489 }
490
491 if (table->reassembled_table != NULL((void*)0)) {
492 /*
493 * The reassembled-packet hash table exists.
494 *
495 * Remove all entries and free reassembled packet
496 * data and key for each entry.
497 */
498 g_hash_table_remove_all(table->reassembled_table);
499 } else {
500 /* The fragment table does not exist. Create it */
501 table->reassembled_table = g_hash_table_new_full(reassembled_hash,
502 reassembled_equal, reassembled_key_free, unref_fd_head);
503 }
504}
505
506/*
507 * Destroy a reassembly table.
508 */
509void
510reassembly_table_destroy(reassembly_table *table)
511{
512 /*
513 * Clear the function pointers.
514 */
515 table->temporary_key_func = NULL((void*)0);
516 table->persistent_key_func = NULL((void*)0);
517 table->free_temporary_key_func = NULL((void*)0);
518 if (table->fragment_table != NULL((void*)0)) {
519 /*
520 * The fragment hash table exists.
521 *
522 * Remove all entries and free fragment data for each entry.
523 *
524 * The keys, and anything to which they point, are freed by
525 * calling the table's key freeing function. The values
526 * are freed in free_all_fragments().
527 */
528 g_hash_table_foreach_remove(table->fragment_table,
529 free_all_fragments, NULL((void*)0));
530
531 /*
532 * Now destroy the hash table.
533 */
534 g_hash_table_destroy(table->fragment_table);
535 table->fragment_table = NULL((void*)0);
536 }
537 if (table->reassembled_table != NULL((void*)0)) {
538 /*
539 * The reassembled-packet hash table exists.
540 *
541 * Remove all entries and free reassembled packet
542 * data and key for each entry.
543 */
544
545 g_hash_table_remove_all(table->reassembled_table);
546
547 /*
548 * Now destroy the hash table.
549 */
550 g_hash_table_destroy(table->reassembled_table);
551 table->reassembled_table = NULL((void*)0);
552 }
553}
554
555/*
556 * Look up an fd_head in the fragment table, optionally returning the key
557 * for it.
558 */
559static fragment_head *
560lookup_fd_head(reassembly_table *table, const packet_info *pinfo,
561 const uint32_t id, const void *data, void * *orig_keyp)
562{
563 void *key;
564 void *value;
565
566 /* Create key to search hash with */
567 key = table->temporary_key_func(pinfo, id, data);
568
569 /*
570 * Look up the reassembly in the fragment table.
571 */
572 if (!g_hash_table_lookup_extended(table->fragment_table, key, orig_keyp,
573 &value))
574 value = NULL((void*)0);
575 /* Free the key */
576 table->free_temporary_key_func(key);
577
578 return (fragment_head *)value;
579}
580
581/*
582 * Insert an fd_head into the fragment table, and return the key used.
583 */
584static void *
585insert_fd_head(reassembly_table *table, fragment_head *fd_head,
586 const packet_info *pinfo, const uint32_t id, const void *data)
587{
588 void *key;
589
590 /*
591 * We're going to use the key to insert the fragment,
592 * so make a persistent version of it.
593 */
594 key = table->persistent_key_func(pinfo, id, data);
595 g_hash_table_insert(table->fragment_table, key, fd_head);
596 return key;
597}
598
599/* This function cleans up the stored state and removes the reassembly data and
600 * (with one exception) all allocated memory for matching reassembly.
601 *
602 * The exception is :
603 * If the PDU was already completely reassembled, then the tvbuff containing the
604 * reassembled data WILL NOT be free()d, and the pointer to that tvbuff will be
605 * returned.
606 * Othervise the function will return NULL.
607 *
608 * So, if you call fragment_delete and it returns non-NULL, YOU are responsible
609 * to tvb_free() that tvbuff.
610 */
611tvbuff_t *
612fragment_delete(reassembly_table *table, const packet_info *pinfo,
613 const uint32_t id, const void *data)
614{
615 fragment_head *fd_head;
616 fragment_item *fd;
617 tvbuff_t *fd_tvb_data=NULL((void*)0);
618 void *key;
619
620 fd_head = lookup_fd_head(table, pinfo, id, data, &key);
621 if(fd_head==NULL((void*)0)){
622 /* We do not recognize this as a PDU we have seen before. return */
623 return NULL((void*)0);
624 }
625
626 fd_tvb_data=fd_head->tvb_data;
627 /* loop over all partial fragments and free any tvbuffs */
628 for(fd=fd_head->next;fd;){
629 fragment_item *tmp_fd;
630 tmp_fd=fd->next;
631
632 if (fd->tvb_data && !(fd->flags & FD_SUBSET_TVB0x0020))
633 tvb_free(fd->tvb_data);
634 g_slice_free(fragment_item, fd)do { if (1) g_slice_free1 (sizeof (fragment_item), (fd)); else
(void) ((fragment_item*) 0 == (fd)); } while (0)
;
635 fd=tmp_fd;
636 }
637 g_slice_free(fragment_head, fd_head)do { if (1) g_slice_free1 (sizeof (fragment_head), (fd_head))
; else (void) ((fragment_head*) 0 == (fd_head)); } while (0)
;
638 g_hash_table_remove(table->fragment_table, key);
639
640 return fd_tvb_data;
641}
642
643/* This function is used to check if there is partial or completed reassembly state
644 * matching this packet. I.e. Is there reassembly going on or not for this packet?
645 */
646fragment_head *
647fragment_get(reassembly_table *table, const packet_info *pinfo,
648 const uint32_t id, const void *data)
649{
650 return lookup_fd_head(table, pinfo, id, data, NULL((void*)0));
651}
652
653fragment_head *
654fragment_get_reassembled_id(reassembly_table *table, const packet_info *pinfo,
655 const uint32_t id)
656{
657 fragment_head *fd_head;
658 reassembled_key key;
659
660 /* create key to search hash with */
661 key.frame = pinfo->num;
662 key.id = id;
663 fd_head = (fragment_head *)g_hash_table_lookup(table->reassembled_table, &key);
664
665 return fd_head;
666}
667
668/* To specify the offset for the fragment numbering, the first fragment is added with 0, and
669 * afterwards this offset is set. All additional calls to off_seq_check will calculate
670 * the number in sequence in regards to the offset */
671void
672fragment_add_seq_offset(reassembly_table *table, const packet_info *pinfo, const uint32_t id,
673 const void *data, const uint32_t fragment_offset)
674{
675 fragment_head *fd_head;
676
677 fd_head = lookup_fd_head(table, pinfo, id, data, NULL((void*)0));
678 if (!fd_head)
679 return;
680
681 /* Resetting the offset is not allowed */
682 if ( fd_head->fragment_nr_offset != 0 )
683 return;
684
685 fd_head->fragment_nr_offset = fragment_offset;
686}
687
688static void
689update_first_gap(fragment_head *fd_head, fragment_item *inserted, bool_Bool multi_insert)
690{
691 uint32_t frag_end = inserted->offset + inserted->len;
692 fragment_item *iter;
693 uint32_t contiguous;
694
695 if (inserted->offset > fd_head->contiguous_len) {
696 /* first inserted node is after first gap */
697 return;
698 } else if (fd_head->first_gap == NULL((void*)0)) {
699 /* we haven't seen first fragment yet */
700 if (inserted->offset != 0) {
701 /* inserted node is not first fragment */
702 return;
703 }
704 contiguous = inserted->len;
705 iter = inserted;
706 } else {
707 contiguous = MAX(fd_head->contiguous_len, frag_end)(((fd_head->contiguous_len) > (frag_end)) ? (fd_head->
contiguous_len) : (frag_end))
;
708 iter = multi_insert ? inserted : fd_head->first_gap;
709 }
710
711 while (iter->next) {
712 if (iter->next->offset > contiguous) {
713 break;
714 }
715 iter = iter->next;
716 contiguous = MAX(contiguous, iter->offset + iter->len)(((contiguous) > (iter->offset + iter->len)) ? (contiguous
) : (iter->offset + iter->len))
;
717 }
718
719 /* iter is either pointing to last fragment before gap or tail */
720 fd_head->first_gap = iter;
721 fd_head->contiguous_len = contiguous;
722}
723
724/*
725 * Keeping first gap and contiguous length in sync significantly speeds up
726 * LINK_FRAG() when fragments in capture file are mostly ordered. However, when
727 * fragments are removed from the list, the first gap can point to fragments
728 * that were either moved to another list or freed. Therefore when any fragment
729 * before first gap is removed, the first gap (and contiguous length) must be
730 * invalidated.
731 */
732static void fragment_reset_first_gap(fragment_head *fd_head)
733{
734 fd_head->first_gap = NULL((void*)0);
735 fd_head->contiguous_len = 0;
736 if (fd_head->next) {
737 bool_Bool multi_insert = (fd_head->next->next != NULL((void*)0));
738 update_first_gap(fd_head, fd_head->next, multi_insert);
739 }
740}
741
742/*
743 * Determines whether list modification requires first gap reset. On entry
744 * modified is NULL if all elements were removed, otherwise it points to
745 * element (reachable from fd_head) whose next pointer was changed.
746 */
747static void fragment_items_removed(fragment_head *fd_head, fragment_item *modified)
748{
749 if ((fd_head->first_gap == modified) ||
750 ((modified != NULL((void*)0)) && (modified->offset > fd_head->contiguous_len))) {
751 /* Removed elements were after first gap */
752 return;
753 }
754 fragment_reset_first_gap(fd_head);
755}
756
757/*
758 * For use with fragment_add (and not the fragment_add_seq functions).
759 * When the reassembled result is wrong (perhaps it needs to be extended), this
760 * function clears any previous reassembly result, allowing the new reassembled
761 * length to be set again.
762 */
763static void
764fragment_reset_defragmentation(fragment_head *fd_head)
765{
766 /* Caller must ensure that this function is only called when
767 * defragmentation is safe to undo. */
768 DISSECTOR_ASSERT(fd_head->flags & FD_DEFRAGMENTED)((void) ((fd_head->flags & 0x0001) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/reassemble.c", 768, "fd_head->flags & 0x0001"
))))
;
769
770 for (fragment_item *fd_i = fd_head->next; fd_i; fd_i = fd_i->next) {
771 if (!fd_i->tvb_data) {
772 fd_i->tvb_data = tvb_new_subset_remaining(fd_head->tvb_data, fd_i->offset);
773 fd_i->flags |= FD_SUBSET_TVB0x0020;
774 }
775 fd_i->flags &= (~FD_TOOLONGFRAGMENT0x0010) & (~FD_MULTIPLETAILS0x0008);
776 }
777 fd_head->flags &= ~(FD_DEFRAGMENTED0x0001|FD_PARTIAL_REASSEMBLY0x0040|FD_DATALEN_SET0x0400);
778 fd_head->flags &= ~(FD_TOOLONGFRAGMENT0x0010|FD_MULTIPLETAILS0x0008);
779 fd_head->datalen = 0;
780 fd_head->reassembled_in = 0;
781 fd_head->reas_in_layer_num = 0;
782}
783
784/* This function can be used to explicitly set the total length (if known)
785 * for reassembly of a PDU.
786 * This is useful for reassembly of PDUs where one may have the total length specified
787 * in the first fragment instead of as for, say, IPv4 where a flag indicates which
788 * is the last fragment.
789 *
790 * Such protocols might fragment_add with a more_frags==true for every fragment
791 * and just tell the reassembly engine the expected total length of the reassembled data
792 * using fragment_set_tot_len immediately after doing fragment_add for the first packet.
793 *
794 * Note that for FD_BLOCKSEQUENCE tot_len is the index for the tail fragment.
795 * i.e. since the block numbers start at 0, if we specify tot_len==2, that
796 * actually means we want to defragment 3 blocks, block 0, 1 and 2.
797 */
798void
799fragment_set_tot_len(reassembly_table *table, const packet_info *pinfo,
800 const uint32_t id, const void *data, const uint32_t tot_len)
801{
802 fragment_head *fd_head;
803 fragment_item *fd;
804 uint32_t max_offset = 0;
805
806 fd_head = lookup_fd_head(table, pinfo, id, data, NULL((void*)0));
807 if (!fd_head)
808 return;
809
810 /* If we're setting a block sequence number, verify that it
811 * doesn't conflict with values set by existing fragments.
812 * XXX - eliminate this check?
813 */
814 if (fd_head->flags & FD_BLOCKSEQUENCE0x0100) {
815 for (fd = fd_head->next; fd; fd = fd->next) {
816 if (fd->offset > max_offset) {
817 max_offset = fd->offset;
818 if (max_offset > tot_len) {
819 fd_head->error = "Bad total reassembly block count";
820 THROW_MESSAGE(ReassemblyError, fd_head->error)except_throw(1, (9), (fd_head->error));
821 }
822 }
823 }
824 }
825
826 if (fd_head->flags & FD_DEFRAGMENTED0x0001) {
827 if (max_offset != tot_len) {
828 fd_head->error = "Defragmented complete but total length not satisfied";
829 THROW_MESSAGE(ReassemblyError, fd_head->error)except_throw(1, (9), (fd_head->error));
830 }
831 }
832
833 /* We got this far so the value is sane. */
834 fd_head->datalen = tot_len;
835 fd_head->flags |= FD_DATALEN_SET0x0400;
836}
837
838void
839fragment_reset_tot_len(reassembly_table *table, const packet_info *pinfo,
840 const uint32_t id, const void *data, const uint32_t tot_len)
841{
842 fragment_head *fd_head;
843
844 fd_head = lookup_fd_head(table, pinfo, id, data, NULL((void*)0));
845 if (!fd_head)
846 return;
847
848 /*
849 * If FD_PARTIAL_REASSEMBLY is set, it would make the next fragment_add
850 * call set the reassembled length based on the fragment offset and
851 * length. As the length is known now, be sure to disable that magic.
852 */
853 fd_head->flags &= ~FD_PARTIAL_REASSEMBLY0x0040;
854
855 /* If the length is already as expected, there is nothing else to do. */
856 if (tot_len == fd_head->datalen)
857 return;
858
859 if (fd_head->flags & FD_DEFRAGMENTED0x0001) {
860 /*
861 * Fragments were reassembled before, clear it to allow
862 * increasing the reassembled length.
863 */
864 fragment_reset_defragmentation(fd_head);
865 }
866
867 fd_head->datalen = tot_len;
868 fd_head->flags |= FD_DATALEN_SET0x0400;
869}
870
871void
872fragment_truncate(reassembly_table *table, const packet_info *pinfo,
873 const uint32_t id, const void *data, const uint32_t tot_len)
874
875{
876 tvbuff_t *old_tvb_data;
877 fragment_head *fd_head;
878
879 fd_head = lookup_fd_head(table, pinfo, id, data, NULL((void*)0));
880 if (!fd_head)
881 return;
882
883 /* Caller must ensure that this function is only called when
884 * we are defragmented. */
885 DISSECTOR_ASSERT(fd_head->flags & FD_DEFRAGMENTED)((void) ((fd_head->flags & 0x0001) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/reassemble.c", 885, "fd_head->flags & 0x0001"
))))
;
886
887 /*
888 * If FD_PARTIAL_REASSEMBLY is set, it would make the next fragment_add
889 * call set the reassembled length based on the fragment offset and
890 * length. As the length is known now, be sure to disable that magic.
891 */
892 fd_head->flags &= ~FD_PARTIAL_REASSEMBLY0x0040;
893
894 /* If the length is already as expected, there is nothing else to do. */
895 if (tot_len == fd_head->datalen)
896 return;
897
898 DISSECTOR_ASSERT(fd_head->datalen > tot_len)((void) ((fd_head->datalen > tot_len) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/reassemble.c", 898, "fd_head->datalen > tot_len"
))))
;
899
900 old_tvb_data=fd_head->tvb_data;
901 fd_head->tvb_data = tvb_clone_offset_len(old_tvb_data, 0, tot_len);
902 tvb_set_free_cb(fd_head->tvb_data, g_free);
903
904 if (old_tvb_data)
905 tvb_add_to_chain(fd_head->tvb_data, old_tvb_data);
906 fd_head->datalen = tot_len;
907
908 /* Keep the fragments before the split point, dividing any if
909 * necessary.
910 * XXX: In rare cases, there might be fragments marked as overlap that
911 * have data both before and after the split point, and which only
912 * overlap after the split point. In that case, after dividing the
913 * fragments the first part no longer overlap.
914 * However, at this point we can't test for overlap conflicts,
915 * so we'll just leave the overlap flags as-is.
916 */
917 fd_head->flags &= ~(FD_OVERLAP0x0002|FD_OVERLAPCONFLICT0x0004|FD_TOOLONGFRAGMENT0x0010|FD_MULTIPLETAILS0x0008);
918 fragment_item *fd_i, *prev_fd = NULL((void*)0);
919 for (fd_i = fd_head->next; fd_i && (fd_i->offset < tot_len); fd_i = fd_i->next) {
920 fd_i->flags &= ~(FD_TOOLONGFRAGMENT0x0010|FD_MULTIPLETAILS0x0008);
921 /* Check for the split point occurring in the middle of the
922 * fragment. */
923 if (fd_i->offset + fd_i->len > tot_len) {
924 fd_i->len = tot_len - fd_i->offset;
925 }
926 fd_head->flags |= fd_i->flags & (FD_OVERLAP0x0002|FD_OVERLAPCONFLICT0x0004);
927 prev_fd = fd_i;
928
929 /* Below should do nothing since this is already defragmented */
930 if (fd_i->flags & FD_SUBSET_TVB0x0020)
931 fd_i->flags &= ~FD_SUBSET_TVB0x0020;
932 else if (fd_i->tvb_data)
933 tvb_free(fd_i->tvb_data);
934
935 fd_i->tvb_data=NULL((void*)0);
936 }
937
938 /* Remove all the other fragments, as they are past the split point. */
939 if (prev_fd) {
940 prev_fd->next = NULL((void*)0);
941 } else {
942 fd_head->next = NULL((void*)0);
943 }
944 fd_head->contiguous_len = MIN(fd_head->contiguous_len, tot_len)(((fd_head->contiguous_len) < (tot_len)) ? (fd_head->
contiguous_len) : (tot_len))
;
945 fragment_items_removed(fd_head, prev_fd);
946 fragment_item *tmp_fd;
947 for (; fd_i; fd_i = tmp_fd) {
948 tmp_fd=fd_i->next;
949
950 if (fd_i->tvb_data && !(fd_i->flags & FD_SUBSET_TVB0x0020))
951 tvb_free(fd_i->tvb_data);
952 g_slice_free(fragment_item, fd_i)do { if (1) g_slice_free1 (sizeof (fragment_item), (fd_i)); else
(void) ((fragment_item*) 0 == (fd_i)); } while (0)
;
953 }
954}
955
956uint32_t
957fragment_get_tot_len(reassembly_table *table, const packet_info *pinfo,
958 const uint32_t id, const void *data)
959{
960 fragment_head *fd_head;
961
962 fd_head = lookup_fd_head(table, pinfo, id, data, NULL((void*)0));
963
964 if(fd_head){
965 return fd_head->datalen;
966 }
967
968 return 0;
969}
970
971/* This function will set the partial reassembly flag for a fh.
972 When this function is called, the fh MUST already exist, i.e.
973 the fh MUST be created by the initial call to fragment_add() before
974 this function is called.
975 Also note that this function MUST be called to indicate a fh will be
976 extended (increase the already stored data)
977*/
978
979void
980fragment_set_partial_reassembly(reassembly_table *table,
981 const packet_info *pinfo, const uint32_t id,
982 const void *data)
983{
984 fragment_head *fd_head;
985
986 fd_head = lookup_fd_head(table, pinfo, id, data, NULL((void*)0));
987
988 /*
989 * XXX - why not do all the stuff done early in "fragment_add_work()",
990 * turning off FD_DEFRAGMENTED and pointing the fragments' data
991 * pointers to the appropriate part of the already-reassembled
992 * data, and clearing the data length and "reassembled in" frame
993 * number, here? We currently have a hack in the TCP dissector
994 * not to set the "reassembled in" value if the "partial reassembly"
995 * flag is set, so that in the first pass through the packets
996 * we don't falsely set a packet as reassembled in that packet
997 * if the dissector decided that even more reassembly was needed.
998 */
999 if(fd_head){
1000 fd_head->flags |= FD_PARTIAL_REASSEMBLY0x0040;
1001 }
1002}
1003
1004/*
1005 * This function gets rid of an entry from a fragment table, given
1006 * a pointer to the key for that entry.
1007 *
1008 * The key freeing routine will be called by g_hash_table_remove().
1009 */
1010static void
1011fragment_unhash(reassembly_table *table, void *key)
1012{
1013 /*
1014 * Remove the entry from the fragment table.
1015 */
1016 g_hash_table_remove(table->fragment_table, key);
1017}
1018
1019/*
1020 * This function adds fragment_head structure to a reassembled-packet
1021 * hash table, using the frame numbers of each of the frames from
1022 * which it was reassembled as keys, and sets the "reassembled_in"
1023 * frame number.
1024 */
1025static void
1026fragment_reassembled(reassembly_table *table, fragment_head *fd_head,
1027 const packet_info *pinfo, const uint32_t id)
1028{
1029 reassembled_key *new_key;
1030 fragment_item *fd;
1031
1032 fd_head->ref_count = 0;
1033 if (fd_head->next == NULL((void*)0)) {
1034 /*
1035 * This was not fragmented, so there's no fragment
1036 * table; just hash it using the current frame number.
1037 */
1038 new_key = g_slice_new(reassembled_key)((reassembled_key*) g_slice_alloc (sizeof (reassembled_key)));
1039 new_key->frame = pinfo->num;
1040 new_key->id = id;
1041 reassembled_table_insert(table->reassembled_table, new_key, fd_head);
1042 } else {
1043 /*
1044 * Hash it with the frame numbers for all the frames.
1045 */
1046 for (fd = fd_head->next; fd != NULL((void*)0); fd = fd->next){
1047 new_key = g_slice_new(reassembled_key)((reassembled_key*) g_slice_alloc (sizeof (reassembled_key)));
1048 new_key->frame = fd->frame;
1049 new_key->id = id;
1050 reassembled_table_insert(table->reassembled_table, new_key, fd_head);
1051 }
1052 }
1053 fd_head->flags |= FD_DEFRAGMENTED0x0001;
1054 fd_head->reassembled_in = pinfo->num;
1055 fd_head->reas_in_layer_num = pinfo->curr_layer_num;
1056}
1057
1058/*
1059 * This function is a variant of the above for the single sequence
1060 * case, using id+offset (i.e., the original sequence number) for the id
1061 * in the key.
1062 */
1063static void
1064fragment_reassembled_single(reassembly_table *table, fragment_head *fd_head,
1065 const packet_info *pinfo, const uint32_t id)
1066{
1067 reassembled_key *new_key;
1068 fragment_item *fd;
1069
1070 fd_head->ref_count = 0;
1071 if (fd_head->next == NULL((void*)0)) {
1072 /*
1073 * This was not fragmented, so there's no fragment
1074 * table; just hash it using the current frame number.
1075 */
1076 new_key = g_slice_new(reassembled_key)((reassembled_key*) g_slice_alloc (sizeof (reassembled_key)));
1077 new_key->frame = pinfo->num;
1078 new_key->id = id;
1079 reassembled_table_insert(table->reassembled_table, new_key, fd_head);
1080 } else {
1081 /*
1082 * Hash it with the frame numbers for all the frames.
1083 */
1084 for (fd = fd_head->next; fd != NULL((void*)0); fd = fd->next){
1085 new_key = g_slice_new(reassembled_key)((reassembled_key*) g_slice_alloc (sizeof (reassembled_key)));
1086 new_key->frame = fd->frame;
1087 new_key->id = id + fd->offset;
1088 reassembled_table_insert(table->reassembled_table, new_key, fd_head);
1089 }
1090 }
1091 fd_head->flags |= FD_DEFRAGMENTED0x0001;
1092 fd_head->reassembled_in = pinfo->num;
1093 fd_head->reas_in_layer_num = pinfo->curr_layer_num;
1094}
1095
1096static void
1097LINK_FRAG(fragment_head *fd_head,fragment_item *fd)
1098{
1099 fragment_item *fd_i;
1100
1101 /* add fragment to list, keep list sorted */
1102 if (fd_head->next == NULL((void*)0) || fd->offset < fd_head->next->offset) {
1103 /* New first fragment */
1104 fd->next = fd_head->next;
1105 fd_head->next = fd;
1106 } else {
1107 fd_i = fd_head->next;
1108 if (fd_head->first_gap != NULL((void*)0)) {
1109 if (fd->offset >= fd_head->first_gap->offset) {
1110 /* fragment is after first gap */
1111 fd_i = fd_head->first_gap;
1112 }
1113 }
1114 for(; fd_i->next; fd_i=fd_i->next) {
1115 if (fd->offset < fd_i->next->offset )
1116 break;
1117 }
1118 fd->next = fd_i->next;
1119 fd_i->next = fd;
1120 }
1121
1122 update_first_gap(fd_head, fd, false0);
1123}
1124
1125static void
1126MERGE_FRAG(fragment_head *fd_head, fragment_item *fd)
1127{
1128 fragment_item *fd_i, *tmp, *inserted = fd;
1129 bool_Bool multi_insert;
1130
1131 if (fd == NULL((void*)0)) return;
1132
1133 multi_insert = (fd->next != NULL((void*)0));
1134
1135 if (fd_head->next == NULL((void*)0)) {
1136 fd_head->next = fd;
1137 update_first_gap(fd_head, fd, multi_insert);
1138 return;
1139 }
1140
1141 if ((fd_head->first_gap != NULL((void*)0)) &&
1142 (fd->offset >= fd_head->first_gap->offset)) {
1143 /* all new fragments go after first gap */
1144 fd_i = fd_head->first_gap;
1145 } else {
1146 /* at least one new fragment goes before first gap */
1147 if (fd->offset < fd_head->next->offset) {
1148 /* inserted fragment is new head, "swap" the lists */
1149 tmp = fd_head->next;
1150 fd_head->next = fd;
1151 fd = tmp;
1152 }
1153 fd_i = fd_head->next;
1154 }
1155
1156 /* Traverse the list linked to fragment head ("main" list), checking if
1157 * fd pointer ("merge" list) should go before or after fd_i->next. Swap
1158 * fd_i->next ("main") and fd pointers ("merge") if "merge" list should
1159 * go before iterated element (fd_i). After the swap what formerly was
1160 * "merge" list essentially becomes part of "main" list (just detached
1161 * element, i.e. fd, is now head of new "merge list").
1162 */
1163 for(; fd_i->next; fd_i=fd_i->next) {
1164 if (fd->offset < fd_i->next->offset) {
1165 tmp = fd_i->next;
1166 fd_i->next = fd;
1167 fd = tmp;
1168 }
1169 }
1170 /* Reached "main" list end, attach remaining elements */
1171 fd_i->next = fd;
1172
1173 update_first_gap(fd_head, inserted, multi_insert);
1174}
1175
1176/*
1177 * This function adds a new fragment to the fragment hash table.
1178 * If this is the first fragment seen for this datagram, a new entry
1179 * is created in the hash table, otherwise this fragment is just added
1180 * to the linked list of fragments for this packet.
1181 * The list of fragments for a specific datagram is kept sorted for
1182 * easier handling.
1183 *
1184 * Returns a pointer to the head of the fragment data list if we have all the
1185 * fragments, NULL otherwise.
1186 *
1187 * This function assumes frag_offset being a byte offset into the defragment
1188 * packet.
1189 *
1190 * 01-2002
1191 * Once the fh is defragmented (= FD_DEFRAGMENTED set), it can be
1192 * extended using the FD_PARTIAL_REASSEMBLY flag. This flag should be set
1193 * using fragment_set_partial_reassembly() before calling fragment_add
1194 * with the new fragment. FD_TOOLONGFRAGMENT and FD_MULTIPLETAILS flags
1195 * are lowered when a new extension process is started.
1196 */
1197static bool_Bool
1198fragment_add_work(fragment_head *fd_head, tvbuff_t *tvb, const int offset,
1199 const packet_info *pinfo, const uint32_t frag_offset,
1200 const uint32_t frag_data_len, const bool_Bool more_frags,
1201 const uint32_t frag_frame, const bool_Bool allow_overlaps)
1202{
1203 fragment_item *fd;
1204 fragment_item *fd_i;
1205 uint32_t dfpos, fraglen, overlap;
1206 tvbuff_t *old_tvb_data;
1207 uint8_t *data;
1208
1209 /* create new fd describing this fragment */
1210 fd = g_slice_new(fragment_item)((fragment_item*) g_slice_alloc (sizeof (fragment_item)));
1211 fd->next = NULL((void*)0);
1212 fd->flags = 0;
1213 fd->frame = frag_frame;
1214 fd->offset = frag_offset;
1215 fd->len = frag_data_len;
1216 fd->tvb_data = NULL((void*)0);
1217
1218 /*
1219 * Are we adding to an already-completed reassembly?
1220 */
1221 if (fd_head->flags & FD_DEFRAGMENTED0x0001) {
1222 /*
1223 * Yes. Does this fragment go past the end of the results
1224 * of that reassembly?
1225 */
1226 if (frag_offset + frag_data_len > fd_head->datalen) {
1227 /*
1228 * Yes. Have we been requested to continue reassembly?
1229 */
1230 if (fd_head->flags & FD_PARTIAL_REASSEMBLY0x0040) {
1231 /*
1232 * Yes. Set flag in already empty fds &
1233 * point old fds to malloc'ed data.
1234 */
1235 fragment_reset_defragmentation(fd_head);
1236 } else if (!allow_overlaps) {
1237 /*
1238 * No. Bail out since we have no idea what to
1239 * do with this fragment (and if we keep going
1240 * we'll run past the end of a buffer sooner
1241 * or later).
1242 */
1243 g_slice_free(fragment_item, fd)do { if (1) g_slice_free1 (sizeof (fragment_item), (fd)); else
(void) ((fragment_item*) 0 == (fd)); } while (0)
;
1244
1245 /*
1246 * This is an attempt to add a fragment to a
1247 * reassembly that had already completed.
1248 * If it had no error, we don't want to
1249 * mark it with an error, and if it had an
1250 * error, we don't want to overwrite it, so
1251 * we don't set fd_head->error.
1252 */
1253 if (frag_offset >= fd_head->datalen) {
1254 /*
1255 * The fragment starts past the end
1256 * of the reassembled data.
1257 */
1258 THROW_MESSAGE(ReassemblyError, "New fragment past old data limits")except_throw(1, (9), ("New fragment past old data limits"));
1259 } else {
1260 /*
1261 * The fragment starts before the end
1262 * of the reassembled data, but
1263 * runs past the end. That could
1264 * just be a retransmission with extra
1265 * data, but the calling dissector
1266 * didn't set FD_PARTIAL_REASSEMBLY
1267 * so it won't be handled correctly.
1268 *
1269 * XXX: We could set FD_TOOLONGFRAGMENT
1270 * below instead.
1271 */
1272 THROW_MESSAGE(ReassemblyError, "New fragment overlaps old data (retransmission?)")except_throw(1, (9), ("New fragment overlaps old data (retransmission?)"
))
;
1273 }
1274 }
1275 } else {
1276 /*
1277 * No. That means it overlaps the completed reassembly.
1278 * This is probably a retransmission and normal
1279 * behavior. (If not, it's because the dissector
1280 * doesn't handle reused sequence numbers correctly,
1281 * e.g. #10503). Handle below.
1282 */
1283 }
1284 }
1285
1286 /* Do this after we may have bailed out (above) so that we don't leave
1287 * fd_head->frame in a bad state if we do */
1288 if (fd->frame > fd_head->frame)
1289 fd_head->frame = fd->frame;
1290
1291 if (!more_frags) {
1292 /*
1293 * This is the tail fragment in the sequence.
1294 */
1295 if (fd_head->flags & FD_DATALEN_SET0x0400) {
1296 /* ok we have already seen other tails for this packet
1297 * it might be a duplicate.
1298 */
1299 if (fd_head->datalen != (fd->offset + fd->len) ){
1300 /* Oops, this tail indicates a different packet
1301 * len than the previous ones. Something's wrong.
1302 */
1303 fd->flags |= FD_MULTIPLETAILS0x0008;
1304 fd_head->flags |= FD_MULTIPLETAILS0x0008;
1305 }
1306 } else {
1307 /* This was the first tail fragment; now we know
1308 * what the length of the packet should be.
1309 */
1310 fd_head->datalen = fd->offset + fd->len;
1311 fd_head->flags |= FD_DATALEN_SET0x0400;
1312 }
1313 }
1314
1315
1316
1317 /* If the packet is already defragmented, this MUST be an overlap.
1318 * The entire defragmented packet is in fd_head->data.
1319 * Even if we have previously defragmented this packet, we still
1320 * check it. Someone might play overlap and TTL games.
1321 */
1322 if (fd_head->flags & FD_DEFRAGMENTED0x0001) {
1323 uint32_t end_offset = fd->offset + fd->len;
1324 fd->flags |= FD_OVERLAP0x0002;
1325 fd_head->flags |= FD_OVERLAP0x0002;
1326 /* make sure it's not too long */
1327 /* XXX: We probably don't call this, unlike the _seq()
1328 * functions, because we throw an exception above.
1329 */
1330 if (end_offset > fd_head->datalen || end_offset < fd->offset || end_offset < fd->len) {
1331 fd->flags |= FD_TOOLONGFRAGMENT0x0010;
1332 fd_head->flags |= FD_TOOLONGFRAGMENT0x0010;
1333 }
1334 /* make sure it doesn't conflict with previous data */
1335 else if ( tvb_memeql(fd_head->tvb_data, fd->offset,
1336 tvb_get_ptr(tvb,offset,fd->len),fd->len) ){
1337 fd->flags |= FD_OVERLAPCONFLICT0x0004;
1338 fd_head->flags |= FD_OVERLAPCONFLICT0x0004;
1339 }
1340 /* it was just an overlap, link it and return */
1341 LINK_FRAG(fd_head,fd);
1342 return true1;
1343 }
1344
1345
1346
1347 /* If we have reached this point, the packet is not defragmented yet.
1348 * Save all payload in a buffer until we can defragment.
1349 */
1350 if (!tvb_bytes_exist(tvb, offset, fd->len)) {
1351 g_slice_free(fragment_item, fd)do { if (1) g_slice_free1 (sizeof (fragment_item), (fd)); else
(void) ((fragment_item*) 0 == (fd)); } while (0)
;
1352 THROW(BoundsError)except_throw(1, (1), ((void*)0));
1353 }
1354 fd->tvb_data = tvb_clone_offset_len(tvb, offset, fd->len);
1355 LINK_FRAG(fd_head,fd);
1356
1357
1358 if( !(fd_head->flags & FD_DATALEN_SET0x0400) ){
1359 /* if we don't know the datalen, there are still missing
1360 * packets. Cheaper than the check below.
1361 */
1362 return false0;
1363 }
1364
1365 /* Check if we have received the entire fragment. */
1366 if (fd_head->contiguous_len < fd_head->datalen) {
1367 /*
1368 * The amount of contiguous data we have is less than the
1369 * amount of data we're trying to reassemble, so we haven't
1370 * received all packets yet.
1371 */
1372 return false0;
1373 }
1374
1375 /* we have received an entire packet, defragment it and
1376 * free all fragments
1377 */
1378 /* store old data just in case */
1379 old_tvb_data=fd_head->tvb_data;
1380 data = (uint8_t *) g_malloc(fd_head->datalen);
1381 fd_head->tvb_data = tvb_new_real_data(data, fd_head->datalen, fd_head->datalen);
1382 tvb_set_free_cb(fd_head->tvb_data, g_free);
1383
1384 /* add all data fragments */
1385 for (dfpos=0,fd_i=fd_head->next;fd_i;fd_i=fd_i->next) {
1386 if (fd_i->len) {
1387 /*
1388 * The contiguous length check above also
1389 * ensures that the only gaps that exist here
1390 * are ones where a fragment starts past the
1391 * end of the reassembled datagram, and there's
1392 * a gap between the previous fragment and
1393 * that fragment.
1394 *
1395 * A "DESEGMENT_UNTIL_FIN" was involved wherein the
1396 * FIN packet had an offset less than the highest
1397 * fragment offset seen. [Seen from a fuzz-test:
1398 * bug #2470]).
1399 *
1400 * Note that the "overlap" compare must only be
1401 * done for fragments with (offset+len) <= fd_head->datalen
1402 * and thus within the newly g_malloc'd buffer.
1403 */
1404
1405 if (fd_i->offset >= fd_head->datalen) {
1406 /*
1407 * Fragment starts after the end
1408 * of the reassembled packet.
1409 *
1410 * This can happen if the length was
1411 * set after the offending fragment
1412 * was added to the reassembly.
1413 *
1414 * Flag this fragment, but don't
1415 * try to extract any data from
1416 * it, as there's no place to put
1417 * it.
1418 *
1419 * XXX - add different flag value
1420 * for this.
1421 */
1422 fd_i->flags |= FD_TOOLONGFRAGMENT0x0010;
1423 fd_head->flags |= FD_TOOLONGFRAGMENT0x0010;
1424 } else if (fd_i->offset + fd_i->len < fd_i->offset) {
1425 /* Integer overflow, unhandled by rest of
1426 * code so error out. This check handles
1427 * all possible remaining overflows.
1428 */
1429 fd_head->error = "offset + len < offset";
1430 } else if (!fd_i->tvb_data) {
1431 fd_head->error = "no data";
1432 } else {
1433 fraglen = fd_i->len;
1434 if (fd_i->offset + fraglen > fd_head->datalen) {
1435 /*
1436 * Fragment goes past the end
1437 * of the packet, as indicated
1438 * by the last fragment.
1439 *
1440 * This can happen if the
1441 * length was set after the
1442 * offending fragment was
1443 * added to the reassembly.
1444 *
1445 * Mark it as such, and only
1446 * copy from it what fits in
1447 * the packet.
1448 */
1449 fd_i->flags |= FD_TOOLONGFRAGMENT0x0010;
1450 fd_head->flags |= FD_TOOLONGFRAGMENT0x0010;
1451 fraglen = fd_head->datalen - fd_i->offset;
1452 }
1453 overlap = dfpos - fd_i->offset;
1454 /* Guaranteed to be >= 0, previous code
1455 * has checked for gaps. */
1456 if (overlap) {
1457 /* duplicate/retransmission/overlap */
1458 uint32_t cmp_len = MIN(fd_i->len,overlap)(((fd_i->len) < (overlap)) ? (fd_i->len) : (overlap)
)
;
1459
1460 fd_i->flags |= FD_OVERLAP0x0002;
1461 fd_head->flags |= FD_OVERLAP0x0002;
1462 if ( memcmp(data + fd_i->offset,
1463 tvb_get_ptr(fd_i->tvb_data, 0, cmp_len),
1464 cmp_len)
1465 ) {
1466 fd_i->flags |= FD_OVERLAPCONFLICT0x0004;
1467 fd_head->flags |= FD_OVERLAPCONFLICT0x0004;
1468 }
1469 }
1470 /* XXX: As in the fragment_add_seq funcs
1471 * like fragment_defragment_and_free() the
1472 * existing behavior does not overwrite
1473 * overlapping bytes even if there is a
1474 * conflict. It only adds new bytes.
1475 *
1476 * Since we only add fragments to a reassembly
1477 * if the reassembly isn't complete, the most
1478 * common case for overlap conflicts is when
1479 * an earlier reassembly isn't fully contained
1480 * in the capture, and we've reused an
1481 * indentification number / wrapped around
1482 * offset sequence numbers much later in the
1483 * capture. In that case, we probably *do*
1484 * want to overwrite conflicting bytes, since
1485 * the earlier fragments didn't form a complete
1486 * reassembly and should be effectively thrown
1487 * out rather than mixed with the new ones?
1488 */
1489 if (fd_i->offset + fraglen > dfpos) {
1490 memcpy(data+dfpos,
1491 tvb_get_ptr(fd_i->tvb_data, overlap, fraglen-overlap),
1492 fraglen-overlap);
1493 dfpos = fd_i->offset + fraglen;
1494 }
1495 }
1496
1497 if (fd_i->flags & FD_SUBSET_TVB0x0020)
1498 fd_i->flags &= ~FD_SUBSET_TVB0x0020;
1499 else if (fd_i->tvb_data)
1500 tvb_free(fd_i->tvb_data);
1501
1502 fd_i->tvb_data=NULL((void*)0);
1503 }
1504 }
1505
1506 if (old_tvb_data)
1507 tvb_add_to_chain(tvb, old_tvb_data);
1508 /* mark this packet as defragmented.
1509 allows us to skip any trailing fragments */
1510 fd_head->flags |= FD_DEFRAGMENTED0x0001;
1511 fd_head->reassembled_in=pinfo->num;
1512 fd_head->reas_in_layer_num = pinfo->curr_layer_num;
1513
1514 /* we don't throw until here to avoid leaking old_data and others */
1515 if (fd_head->error) {
1516 THROW_MESSAGE(ReassemblyError, fd_head->error)except_throw(1, (9), (fd_head->error));
1517 }
1518
1519 return true1;
1520}
1521
1522static fragment_head *
1523fragment_add_common(reassembly_table *table, tvbuff_t *tvb, const int offset,
1524 const packet_info *pinfo, const uint32_t id,
1525 const void *data, const uint32_t frag_offset,
1526 const uint32_t frag_data_len, const bool_Bool more_frags,
1527 const bool_Bool check_already_added,
1528 const uint32_t frag_frame)
1529{
1530 fragment_head *fd_head;
1531 fragment_item *fd_item;
1532 bool_Bool already_added;
1533
1534
1535 /*
1536 * Dissector shouldn't give us garbage tvb info.
1537 *
1538 * XXX - should this code take responsibility for preventing
1539 * reassembly if data is missing due to the packets being
1540 * sliced, rather than leaving it up to dissectors?
1541 */
1542 DISSECTOR_ASSERT(tvb_bytes_exist(tvb, offset, frag_data_len))((void) ((tvb_bytes_exist(tvb, offset, frag_data_len)) ? (void
)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/reassemble.c", 1542, "tvb_bytes_exist(tvb, offset, frag_data_len)"
))))
;
1543
1544 fd_head = lookup_fd_head(table, pinfo, id, data, NULL((void*)0));
1545
1546#if 0
1547 /* debug output of associated fragments. */
1548 /* leave it here for future debugging sessions */
1549 if(strcmp(pinfo->current_proto, "DCERPC") == 0) {
1550 printf("proto:%s num:%u id:%u offset:%u len:%u more:%u visited:%u\n",
1551 pinfo->current_proto, pinfo->num, id, frag_offset, frag_data_len, more_frags, pinfo->fd->visited);
1552 if(fd_head != NULL((void*)0)) {
1553 for(fd_item=fd_head->next;fd_item;fd_item=fd_item->next){
1554 printf("fd_frame:%u fd_offset:%u len:%u datalen:%u\n",
1555 fd_item->frame, fd_item->offset, fd_item->len, fd_item->datalen);
1556 }
1557 }
1558 }
1559#endif
1560
1561 /*
1562 * Is this the first pass through the capture?
1563 */
1564 if (!pinfo->fd->visited) {
1565 /*
1566 * Yes, so we could be doing reassembly. If
1567 * "check_already_added" is true, and fd_head is non-null,
1568 * meaning that this fragment would be added to an
1569 * in-progress reassembly, check if we have seen this
1570 * fragment before, i.e., if we have already added it to
1571 * that reassembly. That can be true even on the first pass
1572 * since we sometimes might call a subdissector multiple
1573 * times.
1574 *
1575 * We check both the frame number and the fragment offset,
1576 * so that we support multiple fragments from the same
1577 * frame being added to the same reassembled PDU.
1578 */
1579 if (check_already_added && fd_head != NULL((void*)0)) {
1580 /*
1581 * fd_head->frame is the maximum of the frame
1582 * numbers of all the fragments added to this
1583 * reassembly; if this frame is later than that
1584 * frame, we know it hasn't been added yet.
1585 */
1586 if (frag_frame <= fd_head->frame) {
1587 already_added = false0;
1588 /*
1589 * The first item in the reassembly list
1590 * is not a fragment, it's a data structure
1591 * for the reassembled packet, so we
1592 * start checking with the next item.
1593 */
1594 for (fd_item = fd_head->next; fd_item;
1595 fd_item = fd_item->next) {
1596 if (frag_frame == fd_item->frame &&
1597 frag_offset == fd_item->offset) {
1598 already_added = true1;
1599 break;
1600 }
1601 }
1602 if (already_added) {
1603 /*
1604 * Have we already finished
1605 * reassembling?
1606 */
1607 if (fd_head->flags & FD_DEFRAGMENTED0x0001) {
1608 /*
1609 * Yes.
1610 * XXX - can this ever happen?
1611 */
1612 THROW_MESSAGE(ReassemblyError,except_throw(1, (9), ("Frame already added in first pass"))
1613 "Frame already added in first pass")except_throw(1, (9), ("Frame already added in first pass"));
1614 } else {
1615 /*
1616 * No.
1617 */
1618 return NULL((void*)0);
1619 }
1620 }
1621 }
1622 }
1623 } else {
1624 /*
1625 * No, so we've already done all the reassembly and added
1626 * all the fragments. Do we have a reassembly and, if so,
1627 * have we finished reassembling?
1628 */
1629 if (fd_head != NULL((void*)0) && fd_head->flags & FD_DEFRAGMENTED0x0001) {
1630 /*
1631 * Yes. This is probably being done after the
1632 * first pass, and we've already done the work
1633 * on the first pass.
1634 *
1635 * If the reassembly got a fatal error, throw that
1636 * error again.
1637 */
1638 if (fd_head->error)
1639 THROW_MESSAGE(ReassemblyError, fd_head->error)except_throw(1, (9), (fd_head->error));
1640
1641 /*
1642 * Is it later in the capture than all of the
1643 * fragments in the reassembly?
1644 */
1645 if (frag_frame > fd_head->frame) {
1646 /*
1647 * Yes, so report this as a problem,
1648 * possibly a retransmission.
1649 */
1650 THROW_MESSAGE(ReassemblyError, "New fragment overlaps old data (retransmission?)")except_throw(1, (9), ("New fragment overlaps old data (retransmission?)"
))
;
1651 }
1652
1653 /*
1654 * Does this fragment go past the end of the
1655 * results of that reassembly?
1656 */
1657 if (frag_offset + frag_data_len > fd_head->datalen) {
1658 /*
1659 * Yes.
1660 */
1661 if (frag_offset >= fd_head->datalen) {
1662 /*
1663 * The fragment starts past the
1664 * end of the reassembled data.
1665 */
1666 THROW_MESSAGE(ReassemblyError, "New fragment past old data limits")except_throw(1, (9), ("New fragment past old data limits"));
1667 } else {
1668 /*
1669 * The fragment starts before the end
1670 * of the reassembled data, but
1671 * runs past the end. That could
1672 * just be a retransmission.
1673 */
1674 THROW_MESSAGE(ReassemblyError, "New fragment overlaps old data (retransmission?)")except_throw(1, (9), ("New fragment overlaps old data (retransmission?)"
))
;
1675 }
1676 }
1677
1678 return fd_head;
1679 } else {
1680 /*
1681 * No.
1682 */
1683 return NULL((void*)0);
1684 }
1685 }
1686
1687 if (fd_head==NULL((void*)0)){
1688 /* not found, this must be the first snooped fragment for this
1689 * packet. Create list-head.
1690 */
1691 fd_head = new_head(0);
1692
1693 /*
1694 * Insert it into the hash table.
1695 */
1696 insert_fd_head(table, fd_head, pinfo, id, data);
1697 }
1698
1699 if (fragment_add_work(fd_head, tvb, offset, pinfo, frag_offset,
1700 frag_data_len, more_frags, frag_frame, false0)) {
1701 /*
1702 * Reassembly is complete.
1703 */
1704 return fd_head;
1705 } else {
1706 /*
1707 * Reassembly isn't complete.
1708 */
1709 return NULL((void*)0);
1710 }
1711}
1712
1713fragment_head *
1714fragment_add(reassembly_table *table, tvbuff_t *tvb, const int offset,
1715 const packet_info *pinfo, const uint32_t id, const void *data,
1716 const uint32_t frag_offset, const uint32_t frag_data_len,
1717 const bool_Bool more_frags)
1718{
1719 return fragment_add_common(table, tvb, offset, pinfo, id, data,
1720 frag_offset, frag_data_len, more_frags, true1, pinfo->num);
1721}
1722
1723/*
1724 * For use when you can have multiple fragments in the same frame added
1725 * to the same reassembled PDU, e.g. with ONC RPC-over-TCP.
1726 */
1727fragment_head *
1728fragment_add_multiple_ok(reassembly_table *table, tvbuff_t *tvb,
1729 const int offset, const packet_info *pinfo,
1730 const uint32_t id, const void *data,
1731 const uint32_t frag_offset,
1732 const uint32_t frag_data_len, const bool_Bool more_frags)
1733{
1734 return fragment_add_common(table, tvb, offset, pinfo, id, data,
1735 frag_offset, frag_data_len, more_frags, false0, pinfo->num);
1736}
1737
1738/*
1739 * For use in protocols like TCP when you are adding an out of order segment
1740 * that arrived in an earlier frame because the correct fragment id could not
1741 * be determined until later. By allowing fd->frame to be different than
1742 * pinfo->num, show_fragment_tree will display the correct fragment numbers.
1743 *
1744 * Note that pinfo is still used to set reassembled_in if we have all the
1745 * fragments, so that results on subsequent passes can be the same as the
1746 * first pass.
1747 */
1748fragment_head *
1749fragment_add_out_of_order(reassembly_table *table, tvbuff_t *tvb,
1750 const int offset, const packet_info *pinfo,
1751 const uint32_t id, const void *data,
1752 const uint32_t frag_offset,
1753 const uint32_t frag_data_len,
1754 const bool_Bool more_frags, const uint32_t frag_frame)
1755{
1756 return fragment_add_common(table, tvb, offset, pinfo, id, data,
1757 frag_offset, frag_data_len, more_frags, true1, frag_frame);
1758}
1759
1760fragment_head *
1761fragment_add_check_with_fallback(reassembly_table *table, tvbuff_t *tvb, const int offset,
1762 const packet_info *pinfo, const uint32_t id,
1763 const void *data, const uint32_t frag_offset,
1764 const uint32_t frag_data_len, const bool_Bool more_frags,
1765 const uint32_t fallback_frame)
1766{
1767 reassembled_key reass_key;
1768 fragment_head *fd_head;
1769 void *orig_key;
1770 bool_Bool late_retransmission = false0;
1771
1772 /*
1773 * If this isn't the first pass, look for this frame in the table
1774 * of reassembled packets.
1775 */
1776 if (pinfo->fd->visited) {
1777 reass_key.frame = pinfo->num;
1778 reass_key.id = id;
1779 return (fragment_head *)g_hash_table_lookup(table->reassembled_table, &reass_key);
1780 }
1781
1782 /* Looks up a key in the GHashTable, returning the original key and the associated value
1783 * and a bool which is true if the key was found. This is useful if you need to free
1784 * the memory allocated for the original key, for example before calling g_hash_table_remove()
1785 */
1786 fd_head = lookup_fd_head(table, pinfo, id, data, &orig_key);
1787 if ((fd_head == NULL((void*)0)) && (fallback_frame != pinfo->num)) {
1788 /* Check if there is completed reassembly reachable from fallback frame */
1789 reass_key.frame = fallback_frame;
1790 reass_key.id = id;
1791 fd_head = (fragment_head *)g_hash_table_lookup(table->reassembled_table, &reass_key);
1792 if (fd_head != NULL((void*)0)) {
1793 /* Found completely reassembled packet, hash it with current frame number */
1794 reassembled_key *new_key = g_slice_new(reassembled_key)((reassembled_key*) g_slice_alloc (sizeof (reassembled_key)));
1795 new_key->frame = pinfo->num;
1796 new_key->id = id;
1797 reassembled_table_insert(table->reassembled_table, new_key, fd_head);
1798 late_retransmission = true1;
1799 }
1800 }
1801 if (fd_head == NULL((void*)0)) {
1802 /* not found, this must be the first snooped fragment for this
1803 * packet. Create list-head.
1804 */
1805 fd_head = new_head(0);
1806
1807 /*
1808 * Save the key, for unhashing it later.
1809 */
1810 orig_key = insert_fd_head(table, fd_head, pinfo, id, data);
1811 }
1812
1813 /*
1814 * If this is a short frame, then we can't, and don't, do
1815 * reassembly on it. We just give up.
1816 */
1817 if (!tvb_bytes_exist(tvb, offset, frag_data_len)) {
1818 return NULL((void*)0);
1819 }
1820
1821 if (fragment_add_work(fd_head, tvb, offset, pinfo, frag_offset,
1822 frag_data_len, more_frags, pinfo->num, late_retransmission)) {
1823 /* Nothing left to do if it was a late retransmission */
1824 if (late_retransmission) {
1825 return fd_head;
1826 }
1827 /*
1828 * Reassembly is complete.
1829 * Remove this from the table of in-progress
1830 * reassemblies, add it to the table of
1831 * reassembled packets, and return it.
1832 */
1833
1834 /*
1835 * Remove this from the table of in-progress reassemblies,
1836 * and free up any memory used for it in that table.
1837 */
1838 fragment_unhash(table, orig_key);
1839
1840 /*
1841 * Add this item to the table of reassembled packets.
1842 */
1843 fragment_reassembled(table, fd_head, pinfo, id);
1844 return fd_head;
1845 } else {
1846 /*
1847 * Reassembly isn't complete.
1848 */
1849 return NULL((void*)0);
1850 }
1851}
1852
1853fragment_head *
1854fragment_add_check(reassembly_table *table, tvbuff_t *tvb, const int offset,
1855 const packet_info *pinfo, const uint32_t id,
1856 const void *data, const uint32_t frag_offset,
1857 const uint32_t frag_data_len, const bool_Bool more_frags)
1858{
1859 return fragment_add_check_with_fallback(table, tvb, offset, pinfo, id, data,
1860 frag_offset, frag_data_len, more_frags, pinfo->num);
1861}
1862
1863static void
1864fragment_defragment_and_free (fragment_head *fd_head, const packet_info *pinfo)
1865{
1866 fragment_item *fd_i = NULL((void*)0);
1867 fragment_item *last_fd = NULL((void*)0);
1868 uint32_t dfpos = 0, size = 0;
1869 tvbuff_t *old_tvb_data = NULL((void*)0);
1870 uint8_t *data;
1871
1872 for(fd_i=fd_head->next;fd_i;fd_i=fd_i->next) {
7
Loop condition is false. Execution continues on line 1880
1873 if(!last_fd || last_fd->offset!=fd_i->offset){
1874 size+=fd_i->len;
1875 }
1876 last_fd=fd_i;
1877 }
1878
1879 /* store old data in case the fd_i->data pointers refer to it */
1880 old_tvb_data=fd_head->tvb_data;
1881 data = (uint8_t *) g_malloc(size);
8
Memory is allocated
1882 fd_head->tvb_data = tvb_new_real_data(data, size, size);
1883 tvb_set_free_cb(fd_head->tvb_data, g_free);
1884 fd_head->len = size; /* record size for caller */
1885
1886 /* add all data fragments */
1887 last_fd=NULL((void*)0);
1888 for (fd_i=fd_head->next; fd_i; fd_i=fd_i->next) {
9
Loop condition is false. Execution continues on line 1909
1889 if (fd_i->len) {
1890 if(!last_fd || last_fd->offset != fd_i->offset) {
1891 /* First fragment or in-sequence fragment */
1892 memcpy(data+dfpos, tvb_get_ptr(fd_i->tvb_data, 0, fd_i->len), fd_i->len);
1893 dfpos += fd_i->len;
1894 } else {
1895 /* duplicate/retransmission/overlap */
1896 fd_i->flags |= FD_OVERLAP0x0002;
1897 fd_head->flags |= FD_OVERLAP0x0002;
1898 if(last_fd->len != fd_i->len
1899 || tvb_memeql(last_fd->tvb_data, 0, tvb_get_ptr(fd_i->tvb_data, 0, last_fd->len), last_fd->len) ) {
1900 fd_i->flags |= FD_OVERLAPCONFLICT0x0004;
1901 fd_head->flags |= FD_OVERLAPCONFLICT0x0004;
1902 }
1903 }
1904 }
1905 last_fd=fd_i;
1906 }
1907
1908 /* we have defragmented the pdu, now free all fragments*/
1909 for (fd_i=fd_head->next;fd_i;fd_i=fd_i->next) {
10
Potential leak of memory pointed to by 'data'
1910 if (fd_i->flags & FD_SUBSET_TVB0x0020)
1911 fd_i->flags &= ~FD_SUBSET_TVB0x0020;
1912 else if (fd_i->tvb_data)
1913 tvb_free(fd_i->tvb_data);
1914 fd_i->tvb_data=NULL((void*)0);
1915 }
1916 if (old_tvb_data)
1917 tvb_free(old_tvb_data);
1918
1919 /* mark this packet as defragmented.
1920 * allows us to skip any trailing fragments.
1921 */
1922 fd_head->flags |= FD_DEFRAGMENTED0x0001;
1923 fd_head->reassembled_in=pinfo->num;
1924 fd_head->reas_in_layer_num = pinfo->curr_layer_num;
1925}
1926
1927/*
1928 * This function adds a new fragment to the entry for a reassembly
1929 * operation.
1930 *
1931 * The list of fragments for a specific datagram is kept sorted for
1932 * easier handling.
1933 *
1934 * Returns true if we have all the fragments, false otherwise.
1935 *
1936 * This function assumes frag_number being a block sequence number.
1937 * The bsn for the first block is 0.
1938 */
1939static bool_Bool
1940fragment_add_seq_work(fragment_head *fd_head, tvbuff_t *tvb, const int offset,
1941 const packet_info *pinfo, const uint32_t frag_number,
1942 const uint32_t frag_data_len, const bool_Bool more_frags)
1943{
1944 fragment_item *fd;
1945 fragment_item *fd_i;
1946 fragment_item *last_fd;
1947 uint32_t max, dfpos;
1948 uint32_t frag_number_work;
1949
1950 /* Enables the use of fragment sequence numbers, which do not start with 0 */
1951 frag_number_work = frag_number;
1952 if ( fd_head->fragment_nr_offset != 0 )
1953 if ( frag_number_work >= fd_head->fragment_nr_offset )
1954 frag_number_work = frag_number - fd_head->fragment_nr_offset;
1955
1956 /* if the partial reassembly flag has been set, and we are extending
1957 * the pdu, un-reassemble the pdu. This means pointing old fds to malloc'ed data.
1958 */
1959 if(fd_head->flags & FD_DEFRAGMENTED0x0001 && frag_number_work >= fd_head->datalen &&
1960 fd_head->flags & FD_PARTIAL_REASSEMBLY0x0040){
1961 uint32_t lastdfpos = 0;
1962 dfpos = 0;
1963 for(fd_i=fd_head->next; fd_i; fd_i=fd_i->next){
1964 if( !fd_i->tvb_data ) {
1965 if( fd_i->flags & FD_OVERLAP0x0002 ) {
1966 /* this is a duplicate of the previous
1967 * fragment. */
1968 fd_i->tvb_data = tvb_new_subset_remaining(fd_head->tvb_data, lastdfpos);
1969 } else {
1970 fd_i->tvb_data = tvb_new_subset_remaining(fd_head->tvb_data, dfpos);
1971 lastdfpos = dfpos;
1972 dfpos += fd_i->len;
1973 }
1974 fd_i->flags |= FD_SUBSET_TVB0x0020;
1975 }
1976 fd_i->flags &= (~FD_TOOLONGFRAGMENT0x0010) & (~FD_MULTIPLETAILS0x0008);
1977 }
1978 fd_head->flags &= ~(FD_DEFRAGMENTED0x0001|FD_PARTIAL_REASSEMBLY0x0040|FD_DATALEN_SET0x0400);
1979 fd_head->flags &= (~FD_TOOLONGFRAGMENT0x0010) & (~FD_MULTIPLETAILS0x0008);
1980 fd_head->datalen=0;
1981 fd_head->reassembled_in=0;
1982 fd_head->reas_in_layer_num = 0;
1983 }
1984
1985
1986 /* create new fd describing this fragment */
1987 fd = g_slice_new(fragment_item)((fragment_item*) g_slice_alloc (sizeof (fragment_item)));
1988 fd->next = NULL((void*)0);
1989 fd->flags = 0;
1990 fd->frame = pinfo->num;
1991 fd->offset = frag_number_work;
1992 fd->len = frag_data_len;
1993 fd->tvb_data = NULL((void*)0);
1994
1995 /* fd_head->frame is the maximum of the frame numbers of all the
1996 * fragments added to the reassembly. */
1997 if (fd->frame > fd_head->frame)
1998 fd_head->frame = fd->frame;
1999
2000 if (!more_frags) {
2001 /*
2002 * This is the tail fragment in the sequence.
2003 */
2004 if (fd_head->flags&FD_DATALEN_SET0x0400) {
2005 /* ok we have already seen other tails for this packet
2006 * it might be a duplicate.
2007 */
2008 if (fd_head->datalen != fd->offset ){
2009 /* Oops, this tail indicates a different packet
2010 * len than the previous ones. Something's wrong.
2011 */
2012 fd->flags |= FD_MULTIPLETAILS0x0008;
2013 fd_head->flags |= FD_MULTIPLETAILS0x0008;
2014 }
2015 } else {
2016 /* this was the first tail fragment, now we know the
2017 * sequence number of that fragment (which is NOT
2018 * the length of the packet!)
2019 */
2020 fd_head->datalen = fd->offset;
2021 fd_head->flags |= FD_DATALEN_SET0x0400;
2022 }
2023 }
2024
2025 /* If the packet is already defragmented, this MUST be an overlap.
2026 * The entire defragmented packet is in fd_head->data
2027 * Even if we have previously defragmented this packet, we still check
2028 * check it. Someone might play overlap and TTL games.
2029 */
2030 if (fd_head->flags & FD_DEFRAGMENTED0x0001) {
2031 fd->flags |= FD_OVERLAP0x0002;
2032 fd_head->flags |= FD_OVERLAP0x0002;
2033
2034 /* make sure it's not past the end */
2035 if (fd->offset > fd_head->datalen) {
2036 /* new fragment comes after the end */
2037 fd->flags |= FD_TOOLONGFRAGMENT0x0010;
2038 fd_head->flags |= FD_TOOLONGFRAGMENT0x0010;
2039 LINK_FRAG(fd_head,fd);
2040 return true1;
2041 }
2042 /* make sure it doesn't conflict with previous data */
2043 dfpos=0;
2044 last_fd=NULL((void*)0);
2045 for (fd_i=fd_head->next;fd_i && (fd_i->offset!=fd->offset);fd_i=fd_i->next) {
2046 if (!last_fd || last_fd->offset!=fd_i->offset){
2047 dfpos += fd_i->len;
2048 }
2049 last_fd=fd_i;
2050 }
2051 if(fd_i){
2052 /* new fragment overlaps existing fragment */
2053 if(fd_i->len!=fd->len){
2054 /*
2055 * They have different lengths; this
2056 * is definitely a conflict.
2057 */
2058 fd->flags |= FD_OVERLAPCONFLICT0x0004;
2059 fd_head->flags |= FD_OVERLAPCONFLICT0x0004;
2060 LINK_FRAG(fd_head,fd);
2061 return true1;
2062 }
2063 DISSECTOR_ASSERT(fd_head->len >= dfpos + fd->len)((void) ((fd_head->len >= dfpos + fd->len) ? (void)0
: (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/reassemble.c", 2063, "fd_head->len >= dfpos + fd->len"
))))
;
2064 if (tvb_memeql(fd_head->tvb_data, dfpos,
2065 tvb_get_ptr(tvb,offset,fd->len),fd->len) ){
2066 /*
2067 * They have the same length, but the
2068 * data isn't the same.
2069 */
2070 fd->flags |= FD_OVERLAPCONFLICT0x0004;
2071 fd_head->flags |= FD_OVERLAPCONFLICT0x0004;
2072 LINK_FRAG(fd_head,fd);
2073 return true1;
2074 }
2075 /* it was just an overlap, link it and return */
2076 LINK_FRAG(fd_head,fd);
2077 return true1;
2078 } else {
2079 /*
2080 * New fragment doesn't overlap an existing
2081 * fragment - there was presumably a gap in
2082 * the sequence number space.
2083 *
2084 * XXX - what should we do here? Is it always
2085 * the case that there are no gaps, or are there
2086 * protcols using sequence numbers where there
2087 * can be gaps?
2088 *
2089 * If the former, the check below for having
2090 * received all the fragments should check for
2091 * holes in the sequence number space and for the
2092 * first sequence number being 0. If we do that,
2093 * the only way we can get here is if this fragment
2094 * is past the end of the sequence number space -
2095 * but the check for "fd->offset > fd_head->datalen"
2096 * would have caught that above, so it can't happen.
2097 *
2098 * If the latter, we don't have a good way of
2099 * knowing whether reassembly is complete if we
2100 * get packet out of order such that the "last"
2101 * fragment doesn't show up last - but, unless
2102 * in-order reliable delivery of fragments is
2103 * guaranteed, an implementation of the protocol
2104 * has no way of knowing whether reassembly is
2105 * complete, either.
2106 *
2107 * For now, we just link the fragment in and
2108 * return.
2109 */
2110 LINK_FRAG(fd_head,fd);
2111 return true1;
2112 }
2113 }
2114
2115 /* If we have reached this point, the packet is not defragmented yet.
2116 * Save all payload in a buffer until we can defragment.
2117 */
2118 /* check len, there may be a fragment with 0 len, that is actually the tail */
2119 if (fd->len) {
2120 if (!tvb_bytes_exist(tvb, offset, fd->len)) {
2121 /* abort if we didn't capture the entire fragment due
2122 * to a too-short snapshot length */
2123 g_slice_free(fragment_item, fd)do { if (1) g_slice_free1 (sizeof (fragment_item), (fd)); else
(void) ((fragment_item*) 0 == (fd)); } while (0)
;
2124 return false0;
2125 }
2126
2127 fd->tvb_data = tvb_clone_offset_len(tvb, offset, fd->len);
2128 }
2129 LINK_FRAG(fd_head,fd);
2130
2131
2132 if( !(fd_head->flags & FD_DATALEN_SET0x0400) ){
2133 /* if we don't know the sequence number of the last fragment,
2134 * there are definitely still missing packets. Cheaper than
2135 * the check below.
2136 */
2137 return false0;
2138 }
2139
2140
2141 /* check if we have received the entire fragment
2142 * this is easy since the list is sorted and the head is faked.
2143 * common case the whole list is scanned.
2144 */
2145 max = 0;
2146 for(fd_i=fd_head->next;fd_i;fd_i=fd_i->next) {
2147 if ( fd_i->offset==max ){
2148 max++;
2149 }
2150 }
2151 /* max will now be datalen+1 if all fragments have been seen */
2152
2153 if (max <= fd_head->datalen) {
2154 /* we have not received all packets yet */
2155 return false0;
2156 }
2157
2158
2159 if (max > (fd_head->datalen+1)) {
2160 /* oops, too long fragment detected */
2161 fd->flags |= FD_TOOLONGFRAGMENT0x0010;
2162 fd_head->flags |= FD_TOOLONGFRAGMENT0x0010;
2163 }
2164
2165
2166 /* we have received an entire packet, defragment it and
2167 * free all fragments
2168 */
2169 fragment_defragment_and_free(fd_head, pinfo);
2170
2171 return true1;
2172}
2173
2174/*
2175 * This function adds a new fragment to the fragment hash table.
2176 * If this is the first fragment seen for this datagram, a new entry
2177 * is created in the hash table, otherwise this fragment is just added
2178 * to the linked list of fragments for this packet.
2179 *
2180 * Returns a pointer to the head of the fragment data list if we have all the
2181 * fragments, NULL otherwise.
2182 *
2183 * This function assumes frag_number being a block sequence number.
2184 * The bsn for the first block is 0.
2185 */
2186static fragment_head *
2187fragment_add_seq_common(reassembly_table *table, tvbuff_t *tvb,
2188 const int offset, const packet_info *pinfo,
2189 const uint32_t id, const void *data,
2190 uint32_t frag_number, const uint32_t frag_data_len,
2191 const bool_Bool more_frags, const uint32_t flags,
2192 void * *orig_keyp)
2193{
2194 fragment_head *fd_head;
2195 void *orig_key;
2196
2197 fd_head = lookup_fd_head(table, pinfo, id, data, &orig_key);
2198
2199 /* have we already seen this frame ?*/
2200 if (pinfo->fd->visited) {
2201 if (fd_head != NULL((void*)0) && fd_head->flags & FD_DEFRAGMENTED0x0001) {
2202 if (orig_keyp != NULL((void*)0))
2203 *orig_keyp = orig_key;
2204 return fd_head;
2205 } else {
2206 return NULL((void*)0);
2207 }
2208 }
2209
2210 if (fd_head==NULL((void*)0)){
2211 /* not found, this must be the first snooped fragment for this
2212 * packet. Create list-head.
2213 */
2214 fd_head= new_head(FD_BLOCKSEQUENCE0x0100);
2215
2216 if((flags & (REASSEMBLE_FLAGS_NO_FRAG_NUMBER0x0001|REASSEMBLE_FLAGS_802_11_HACK0x0002))
2217 && !more_frags) {
2218 /*
2219 * This is the last fragment for this packet, and
2220 * is the only one we've seen.
2221 *
2222 * Either we don't have sequence numbers, in which
2223 * case we assume this is the first fragment for
2224 * this packet, or we're doing special 802.11
2225 * processing, in which case we assume it's one
2226 * of those reassembled packets with a non-zero
2227 * fragment number (see packet-80211.c); just
2228 * return a pointer to the head of the list;
2229 * fragment_add_seq_check will then add it to the table
2230 * of reassembled packets.
2231 */
2232 if (orig_keyp != NULL((void*)0))
2233 *orig_keyp = NULL((void*)0);
2234 fd_head->reassembled_in=pinfo->num;
2235 fd_head->reas_in_layer_num = pinfo->curr_layer_num;
2236 return fd_head;
2237 }
2238
2239 orig_key = insert_fd_head(table, fd_head, pinfo, id, data);
2240 if (orig_keyp != NULL((void*)0))
2241 *orig_keyp = orig_key;
2242
2243 /*
2244 * If we weren't given an initial fragment number,
2245 * make it 0.
2246 */
2247 if (flags & REASSEMBLE_FLAGS_NO_FRAG_NUMBER0x0001)
2248 frag_number = 0;
2249 } else {
2250 if (orig_keyp != NULL((void*)0))
2251 *orig_keyp = orig_key;
2252
2253 if (flags & REASSEMBLE_FLAGS_NO_FRAG_NUMBER0x0001) {
2254 fragment_item *fd;
2255 /*
2256 * If we weren't given an initial fragment number,
2257 * use the next expected fragment number as the fragment
2258 * number for this fragment.
2259 */
2260 for (fd = fd_head->next; fd != NULL((void*)0); fd = fd->next) {
2261 if (fd->next == NULL((void*)0))
2262 frag_number = fd->offset + 1;
2263 }
2264 }
2265 }
2266
2267 if (fragment_add_seq_work(fd_head, tvb, offset, pinfo,
2268 frag_number, frag_data_len, more_frags)) {
2269 /*
2270 * Reassembly is complete.
2271 */
2272 return fd_head;
2273 } else {
2274 /*
2275 * Reassembly isn't complete.
2276 */
2277 return NULL((void*)0);
2278 }
2279}
2280
2281fragment_head *
2282fragment_add_seq(reassembly_table *table, tvbuff_t *tvb, const int offset,
2283 const packet_info *pinfo, const uint32_t id, const void *data,
2284 const uint32_t frag_number, const uint32_t frag_data_len,
2285 const bool_Bool more_frags, const uint32_t flags)
2286{
2287 return fragment_add_seq_common(table, tvb, offset, pinfo, id, data,
2288 frag_number, frag_data_len,
2289 more_frags, flags, NULL((void*)0));
2290}
2291
2292/*
2293 * This does the work for "fragment_add_seq_check()" and
2294 * "fragment_add_seq_next()".
2295 *
2296 * This function assumes frag_number being a block sequence number.
2297 * The bsn for the first block is 0.
2298 *
2299 * If REASSEMBLE_FLAGS_NO_FRAG_NUMBER, it uses the next expected fragment number
2300 * as the fragment number if there is a reassembly in progress, otherwise
2301 * it uses 0.
2302 *
2303 * If not REASSEMBLE_FLAGS_NO_FRAG_NUMBER, it uses the "frag_number" argument as
2304 * the fragment number.
2305 *
2306 * If this is the first fragment seen for this datagram, a new
2307 * "fragment_head" structure is allocated to refer to the reassembled
2308 * packet.
2309 *
2310 * This fragment is added to the linked list of fragments for this packet.
2311 *
2312 * If "more_frags" is false and REASSEMBLE_FLAGS_802_11_HACK (as the name
2313 * implies, a special hack for 802.11) or REASSEMBLE_FLAGS_NO_FRAG_NUMBER
2314 * (implying messages must be in order since there's no sequence number) are
2315 * set in "flags", then this (one element) list is returned.
2316 *
2317 * If, after processing this fragment, we have all the fragments,
2318 * "fragment_add_seq_check_work()" removes that from the fragment hash
2319 * table if necessary and adds it to the table of reassembled fragments,
2320 * and returns a pointer to the head of the fragment list.
2321 *
2322 * Otherwise, it returns NULL.
2323 *
2324 * XXX - Should we simply return NULL for zero-length fragments?
2325 */
2326static fragment_head *
2327fragment_add_seq_check_work(reassembly_table *table, tvbuff_t *tvb,
2328 const int offset, const packet_info *pinfo,
2329 const uint32_t id, const void *data,
2330 const uint32_t frag_number,
2331 const uint32_t frag_data_len,
2332 const bool_Bool more_frags, const uint32_t flags)
2333{
2334 reassembled_key reass_key;
2335 fragment_head *fd_head;
2336 void *orig_key;
2337
2338 /*
2339 * Have we already seen this frame?
2340 * If so, look for it in the table of reassembled packets.
2341 */
2342 if (pinfo->fd->visited) {
2343 reass_key.frame = pinfo->num;
2344 reass_key.id = id;
2345 return (fragment_head *)g_hash_table_lookup(table->reassembled_table, &reass_key);
2346 }
2347
2348 fd_head = fragment_add_seq_common(table, tvb, offset, pinfo, id, data,
2349 frag_number, frag_data_len,
2350 more_frags,
2351 flags,
2352 &orig_key);
2353 if (fd_head) {
2354 /*
2355 * Reassembly is complete.
2356 *
2357 * If this is in the table of in-progress reassemblies,
2358 * remove it from that table. (It could be that this
2359 * was the first and last fragment, so that no
2360 * reassembly was done.)
2361 */
2362 if (orig_key != NULL((void*)0))
2363 fragment_unhash(table, orig_key);
2364
2365 /*
2366 * Add this item to the table of reassembled packets.
2367 */
2368 fragment_reassembled(table, fd_head, pinfo, id);
2369 return fd_head;
2370 } else {
2371 /*
2372 * Reassembly isn't complete.
2373 */
2374 return NULL((void*)0);
2375 }
2376}
2377
2378fragment_head *
2379fragment_add_seq_check(reassembly_table *table, tvbuff_t *tvb, const int offset,
2380 const packet_info *pinfo, const uint32_t id,
2381 const void *data,
2382 const uint32_t frag_number, const uint32_t frag_data_len,
2383 const bool_Bool more_frags)
2384{
2385 return fragment_add_seq_check_work(table, tvb, offset, pinfo, id, data,
2386 frag_number, frag_data_len,
2387 more_frags, 0);
2388}
2389
2390fragment_head *
2391fragment_add_seq_802_11(reassembly_table *table, tvbuff_t *tvb,
2392 const int offset, const packet_info *pinfo,
2393 const uint32_t id, const void *data,
2394 const uint32_t frag_number, const uint32_t frag_data_len,
2395 const bool_Bool more_frags)
2396{
2397 return fragment_add_seq_check_work(table, tvb, offset, pinfo, id, data,
2398 frag_number, frag_data_len,
2399 more_frags,
2400 REASSEMBLE_FLAGS_802_11_HACK0x0002);
2401}
2402
2403fragment_head *
2404fragment_add_seq_next(reassembly_table *table, tvbuff_t *tvb, const int offset,
2405 const packet_info *pinfo, const uint32_t id,
2406 const void *data, const uint32_t frag_data_len,
2407 const bool_Bool more_frags)
2408{
2409 /* Use a dummy frag_number (0), it is ignored since
2410 * REASSEMBLE_FLAGS_NO_FRAG_NUMBER is set. */
2411 return fragment_add_seq_check_work(table, tvb, offset, pinfo, id, data,
2412 0, frag_data_len, more_frags,
2413 REASSEMBLE_FLAGS_NO_FRAG_NUMBER0x0001);
2414}
2415
2416static void
2417fragment_add_seq_single_move(reassembly_table *table, const packet_info *pinfo,
2418 const uint32_t id, const void *data,
2419 const uint32_t offset)
2420{
2421 fragment_head *fh, *new_fh;
2422 fragment_item *fd, *prev_fd;
2423 tvbuff_t *old_tvb_data;
2424 if (offset == 0) {
2425 return;
2426 }
2427 fh = lookup_fd_head(table, pinfo, id, data, NULL((void*)0));
2428 if (fh == NULL((void*)0)) {
2429 /* Shouldn't be called this way.
2430 * Probably wouldn't hurt to just create fh in this case. */
2431 ws_assert_not_reached()ws_log_fatal_full("", LOG_LEVEL_ERROR, "epan/reassemble.c", 2431
, __func__, "assertion \"not reached\" failed")
;
2432 return;
2433 }
2434 if (fh->flags & FD_DATALEN_SET0x0400 && fh->datalen <= offset) {
2435 /* Don't take from past the end. <= because we don't
2436 * want to take a First fragment from the next one
2437 * either */
2438 return;
2439 }
2440 new_fh = lookup_fd_head(table, pinfo, id+offset, data, NULL((void*)0));
2441 if (new_fh != NULL((void*)0)) {
2442 /* Attach to the end of the sorted list. */
2443 prev_fd = NULL((void*)0);
2444 for(fd = fh->next; fd != NULL((void*)0); fd=fd->next) {
2445 prev_fd = fd;
2446 }
2447 /* Don't take a reassembly starting with a First fragment. */
2448 fd = new_fh->next;
2449 if (fd && fd->offset != 0) {
2450 fragment_item *inserted = fd;
2451 bool_Bool multi_insert = (inserted->next != NULL((void*)0));
2452 if (prev_fd) {
2453 prev_fd->next = fd;
2454 } else {
2455 fh->next = fd;
2456 }
2457 for (; fd; fd=fd->next) {
2458 fd->offset += offset;
2459 if (fh->frame < fd->frame) {
2460 fh->frame = fd->frame;
2461 }
2462 }
2463 update_first_gap(fh, inserted, multi_insert);
2464 /* If previously found a Last fragment,
2465 * transfer that info to the new one. */
2466 if (new_fh->flags & FD_DATALEN_SET0x0400) {
2467 fh->flags |= FD_DATALEN_SET0x0400;
2468 fh->datalen = new_fh->datalen + offset;
2469 }
2470 /* Now remove and delete */
2471 new_fh->next = NULL((void*)0);
2472 old_tvb_data = fragment_delete(table, pinfo, id+offset, data);
2473 if (old_tvb_data)
2474 tvb_free(old_tvb_data);
2475 }
2476 }
2477}
2478
2479static fragment_head *
2480fragment_add_seq_single_work(reassembly_table *table, tvbuff_t *tvb,
2481 const int offset, const packet_info *pinfo,
2482 const uint32_t id, const void* data,
2483 const uint32_t frag_data_len,
2484 const bool_Bool first, const bool_Bool last,
2485 const uint32_t max_frags, const uint32_t max_age,
2486 const uint32_t flags)
2487{
2488 reassembled_key reass_key;
2489 tvbuff_t *old_tvb_data;
2490 void *orig_key;
2491 fragment_head *fh, *new_fh;
2492 fragment_item *fd, *prev_fd;
2493 uint32_t frag_number, tmp_offset;
2494 /* Have we already seen this frame?
2495 * If so, look for it in the table of reassembled packets.
2496 * Note here we store in the reassembly table by the single sequence
2497 * number rather than the sequence number of the First fragment. */
2498 if (pinfo->fd->visited) {
2499 reass_key.frame = pinfo->num;
2500 reass_key.id = id;
2501 fh = (fragment_head *)g_hash_table_lookup(table->reassembled_table, &reass_key);
2502 return fh;
2503 }
2504 /* First let's figure out where we want to add our new fragment */
2505 fh = NULL((void*)0);
2506 if (first) {
2507 frag_number = 0;
2508 fh = lookup_fd_head(table, pinfo, id-frag_number, data, NULL((void*)0));
2509 if ((flags & REASSEMBLE_FLAGS_AGING0x0001) &&
2510 fh && ((fh->frame + max_age) < pinfo->num)) {
2511 old_tvb_data = fragment_delete(table, pinfo, id-frag_number, data);
2512 if (old_tvb_data)
2513 tvb_free(old_tvb_data);
2514 fh = NULL((void*)0);
2515 }
2516 if (fh == NULL((void*)0)) {
2517 /* Not found. Create list-head. */
2518 fh = new_head(FD_BLOCKSEQUENCE0x0100);
2519 insert_fd_head(table, fh, pinfo, id-frag_number, data);
2520 }
2521 /* As this is the first fragment, we might have added segments
2522 * for this reassembly to the previous one in-progress. */
2523 fd = NULL((void*)0);
2524 for (frag_number=1; frag_number < max_frags; frag_number++) {
2525 new_fh = lookup_fd_head(table, pinfo, id-frag_number, data, NULL((void*)0));
2526 if (new_fh != NULL((void*)0)) {
2527 prev_fd = NULL((void*)0);
2528 new_fh->frame = 0;
2529 for (fd=new_fh->next; fd && fd->offset < frag_number; fd=fd->next) {
2530 prev_fd = fd;
2531 if (new_fh->frame < fd->frame) {
2532 new_fh->frame = fd->frame;
2533 }
2534 }
2535 if (prev_fd) {
2536 prev_fd->next = NULL((void*)0);
2537 } else {
2538 new_fh->next = NULL((void*)0);
2539 }
2540 fragment_items_removed(new_fh, prev_fd);
2541 break;
2542 }
2543 }
2544 if (fd != NULL((void*)0)) {
2545 tmp_offset = 0;
2546 for (prev_fd = fd; prev_fd; prev_fd = prev_fd->next) {
2547 prev_fd->offset -= frag_number;
2548 tmp_offset = prev_fd->offset;
2549 if (fh->frame < prev_fd->frame) {
2550 fh->frame = prev_fd->frame;
2551 }
2552 }
2553 MERGE_FRAG(fh, fd);
2554 if (new_fh != NULL((void*)0)) {
2555 /* If we've moved a Last packet, change datalen.
2556 * Second part of this test prob. redundant? */
2557 if (new_fh->flags & FD_DATALEN_SET0x0400 &&
2558 new_fh->datalen >= frag_number) {
2559 fh->flags |= FD_DATALEN_SET0x0400;
2560 fh->datalen = new_fh->datalen - frag_number;
2561 new_fh->flags &= ~FD_DATALEN_SET0x0400;
2562 new_fh->datalen = 0;
2563 }
2564 /* If we've moved all the fragments,
2565 * delete the old head */
2566 if (new_fh->next == NULL((void*)0)) {
2567 old_tvb_data = fragment_delete(table, pinfo, id-frag_number, data);
2568 if (old_tvb_data)
2569 tvb_free(old_tvb_data);
2570 }
2571 } else {
2572 /* Look forward and take off the next (this is
2573 * necessary in some edge cases where max_frags
2574 * prevented some fragments from going on the
2575 * previous First, but they can go on this one. */
2576 fragment_add_seq_single_move(table, pinfo, id,
2577 data, tmp_offset);
2578 }
2579 }
2580 frag_number = 0; /* For the rest of the function */
2581 } else {
2582 for (frag_number=1; frag_number < max_frags; frag_number++) {
2583 fh = lookup_fd_head(table, pinfo, id-frag_number, data, NULL((void*)0));
2584 if ((flags & REASSEMBLE_FLAGS_AGING0x0001) &&
2585 fh && ((fh->frame + max_age) < pinfo->num)) {
2586 old_tvb_data = fragment_delete(table, pinfo, id-frag_number, data);
2587 if (old_tvb_data)
2588 tvb_free(old_tvb_data);
2589 fh = NULL((void*)0);
2590 }
2591 if (fh != NULL((void*)0)) {
2592 if (fh->flags & FD_DATALEN_SET0x0400 &&
2593 fh->datalen < frag_number) {
2594 /* This fragment is after the Last
2595 * fragment, so must go after here. */
2596 fh = NULL((void*)0);
2597 }
2598 break;
2599 }
2600 }
2601 if (fh == NULL((void*)0)) { /* Didn't find location, use default */
2602 frag_number = 1;
2603 /* Already looked for frag_number 1, so just create */
2604 fh = new_head(FD_BLOCKSEQUENCE0x0100);
2605 insert_fd_head(table, fh, pinfo, id-frag_number, data);
2606 }
2607 }
2608 if (last) {
2609 /* Look for fragments past the end set by this Last fragment. */
2610 prev_fd = NULL((void*)0);
2611 for (fd=fh->next; fd && fd->offset <= frag_number; fd=fd->next) {
2612 prev_fd = fd;
2613 }
2614 /* fd is now all fragments offset > frag_number (the Last).
2615 * It shouldn't have a fragment with offset frag_number+1,
2616 * as that would be a First fragment not marked as such.
2617 * However, this can happen if we had unreassembled fragments
2618 * (missing, or at the start of the capture) and we've also
2619 * looped around on the sequence numbers. It can also happen
2620 * if bit errors mess up Last or First. */
2621 if (fd != NULL((void*)0)) {
2622 if (prev_fd) {
2623 prev_fd->next = NULL((void*)0);
2624 } else {
2625 fh->next = NULL((void*)0);
2626 }
2627 fragment_items_removed(fh, prev_fd);
2628 fh->frame = 0;
2629 for (prev_fd=fh->next; prev_fd; prev_fd=prev_fd->next) {
2630 if (fh->frame < prev_fd->frame) {
2631 fh->frame = prev_fd->frame;
2632 }
2633 }
2634 while (fd && fd->offset == frag_number+1) {
2635 /* Definitely have bad data here. Best to
2636 * delete these and leave unreassembled. */
2637 fragment_item *tmp_fd;
2638 tmp_fd=fd->next;
2639
2640 if (fd->tvb_data && !(fd->flags & FD_SUBSET_TVB0x0020))
2641 tvb_free(fd->tvb_data);
2642 g_slice_free(fragment_item, fd)do { if (1) g_slice_free1 (sizeof (fragment_item), (fd)); else
(void) ((fragment_item*) 0 == (fd)); } while (0)
;
2643 fd=tmp_fd;
2644 }
2645 }
2646 if (fd != NULL((void*)0)) {
2647 /* Move these onto the next frame. */
2648 new_fh = lookup_fd_head(table, pinfo, id+1, data, NULL((void*)0));
2649 if (new_fh==NULL((void*)0)) {
2650 /* Not found. Create list-head. */
2651 new_fh = new_head(FD_BLOCKSEQUENCE0x0100);
2652 insert_fd_head(table, new_fh, pinfo, id+1, data);
2653 }
2654 tmp_offset = 0;
2655 for (prev_fd = fd; prev_fd; prev_fd = prev_fd->next) {
2656 prev_fd->offset -= (frag_number+1);
2657 tmp_offset = prev_fd->offset;
2658 if (new_fh->frame < fd->frame) {
2659 new_fh->frame = fd->frame;
2660 }
2661 }
2662 MERGE_FRAG(new_fh, fd);
2663 /* If we previously found a different Last fragment,
2664 * transfer that information to the new reassembly. */
2665 if (fh->flags & FD_DATALEN_SET0x0400 &&
2666 fh->datalen > frag_number) {
2667 new_fh->flags |= FD_DATALEN_SET0x0400;
2668 new_fh->datalen = fh->datalen - (frag_number+1);
2669 fh->flags &= ~FD_DATALEN_SET0x0400;
2670 fh->datalen = 0;
2671 } else {
2672 /* Look forward and take off the next (this is
2673 * necessary in some edge cases where max_frags
2674 * prevented some fragments from going on the
2675 * previous First, but they can go on this one. */
2676 fragment_add_seq_single_move(table, pinfo, id+1,
2677 data, tmp_offset);
2678 }
2679 }
2680 } else {
2681 fragment_add_seq_single_move(table, pinfo, id-frag_number, data,
2682 frag_number+1);
2683 }
2684 /* Having cleaned up everything, finally ready to add our new
2685 * fragment. Note that only this will ever complete a reassembly. */
2686 fh = fragment_add_seq_common(table, tvb, offset, pinfo,
2687 id-frag_number, data,
2688 frag_number, frag_data_len,
2689 !last, 0, &orig_key);
2690 if (fh) {
2691 /*
2692 * Reassembly is complete.
2693 *
2694 * If this is in the table of in-progress reassemblies,
2695 * remove it from that table. (It could be that this
2696 * was the first and last fragment, so that no
2697 * reassembly was done.)
2698 */
2699 if (orig_key != NULL((void*)0))
2700 fragment_unhash(table, orig_key);
2701
2702 /*
2703 * Add this item to the table of reassembled packets.
2704 */
2705 fragment_reassembled_single(table, fh, pinfo, id-frag_number);
2706 return fh;
2707 } else {
2708 /*
2709 * Reassembly isn't complete.
2710 */
2711 return NULL((void*)0);
2712 }
2713}
2714
2715fragment_head *
2716fragment_add_seq_single(reassembly_table *table, tvbuff_t *tvb,
2717 const int offset, const packet_info *pinfo,
2718 const uint32_t id, const void* data,
2719 const uint32_t frag_data_len,
2720 const bool_Bool first, const bool_Bool last,
2721 const uint32_t max_frags)
2722{
2723 return fragment_add_seq_single_work(table, tvb, offset, pinfo,
2724 id, data, frag_data_len,
2725 first, last, max_frags, 0, 0);
2726}
2727
2728fragment_head *
2729fragment_add_seq_single_aging(reassembly_table *table, tvbuff_t *tvb,
2730 const int offset, const packet_info *pinfo,
2731 const uint32_t id, const void* data,
2732 const uint32_t frag_data_len,
2733 const bool_Bool first, const bool_Bool last,
2734 const uint32_t max_frags, const uint32_t max_age)
2735{
2736 return fragment_add_seq_single_work(table, tvb, offset, pinfo,
2737 id, data, frag_data_len,
2738 first, last, max_frags, max_age,
2739 REASSEMBLE_FLAGS_AGING0x0001);
2740}
2741
2742void
2743fragment_start_seq_check(reassembly_table *table, const packet_info *pinfo,
2744 const uint32_t id, const void *data,
2745 const uint32_t tot_len)
2746{
2747 fragment_head *fd_head;
2748
2749 /* Have we already seen this frame ?*/
2750 if (pinfo->fd->visited) {
2751 return;
2752 }
2753
2754 /* Check if fragment data exists */
2755 fd_head = lookup_fd_head(table, pinfo, id, data, NULL((void*)0));
2756
2757 if (fd_head == NULL((void*)0)) {
2758 /* Create list-head. */
2759 fd_head = g_slice_new(fragment_head)((fragment_head*) g_slice_alloc (sizeof (fragment_head)));
2760 fd_head->next = NULL((void*)0);
2761 fd_head->first_gap = NULL((void*)0);
2762 fd_head->contiguous_len = 0;
2763 fd_head->frame = 0;
2764 fd_head->len = 0;
2765 fd_head->fragment_nr_offset = 0;
2766 fd_head->datalen = tot_len;
2767 fd_head->reassembled_in = 0;
2768 fd_head->reas_in_layer_num = 0;
2769 fd_head->flags = FD_BLOCKSEQUENCE0x0100|FD_DATALEN_SET0x0400;
2770 fd_head->tvb_data = NULL((void*)0);
2771 fd_head->error = NULL((void*)0);
2772
2773 insert_fd_head(table, fd_head, pinfo, id, data);
2774 }
2775}
2776
2777fragment_head *
2778fragment_end_seq_next(reassembly_table *table, const packet_info *pinfo,
2779 const uint32_t id, const void *data)
2780{
2781 reassembled_key reass_key;
2782 reassembled_key *new_key;
2783 fragment_head *fd_head;
2784 fragment_item *fd;
2785 void *orig_key;
2786 uint32_t max_offset = 0;
2787
2788 /*
2789 * Have we already seen this frame?
2790 * If so, look for it in the table of reassembled packets.
2791 */
2792 if (pinfo->fd->visited) {
1
Assuming field 'visited' is 0
2
Taking false branch
2793 reass_key.frame = pinfo->num;
2794 reass_key.id = id;
2795 return (fragment_head *)g_hash_table_lookup(table->reassembled_table, &reass_key);
2796 }
2797
2798 fd_head = lookup_fd_head(table, pinfo, id, data, &orig_key);
2799
2800 if (fd_head) {
3
Assuming 'fd_head' is non-null
4
Taking true branch
2801 for (fd = fd_head->next; fd; fd = fd->next) {
5
Loop condition is false. Execution continues on line 2806
2802 if (fd->offset > max_offset) {
2803 max_offset = fd->offset;
2804 }
2805 }
2806 fd_head->datalen = max_offset;
2807 fd_head->flags |= FD_DATALEN_SET0x0400;
2808
2809 fragment_defragment_and_free (fd_head, pinfo);
6
Calling 'fragment_defragment_and_free'
2810
2811 /*
2812 * Remove this from the table of in-progress reassemblies,
2813 * and free up any memory used for it in that table.
2814 */
2815 fragment_unhash(table, orig_key);
2816
2817 /*
2818 * Add this item to the table of reassembled packets.
2819 */
2820 fragment_reassembled(table, fd_head, pinfo, id);
2821 if (fd_head->next != NULL((void*)0)) {
2822 new_key = g_slice_new(reassembled_key)((reassembled_key*) g_slice_alloc (sizeof (reassembled_key)));
2823 new_key->frame = pinfo->num;
2824 new_key->id = id;
2825 reassembled_table_insert(table->reassembled_table, new_key, fd_head);
2826 }
2827
2828 return fd_head;
2829 } else {
2830 /*
2831 * Fragment data not found.
2832 */
2833 return NULL((void*)0);
2834 }
2835}
2836
2837/*
2838 * Process reassembled data; if we're on the frame in which the data
2839 * was reassembled, put the fragment information into the protocol
2840 * tree, and construct a tvbuff with the reassembled data, otherwise
2841 * just put a "reassembled in" item into the protocol tree.
2842 * offset from start of tvb, result up to end of tvb
2843 */
2844tvbuff_t *
2845process_reassembled_data(tvbuff_t *tvb, const int offset, packet_info *pinfo,
2846 const char *name, fragment_head *fd_head, const fragment_items *fit,
2847 bool_Bool *update_col_infop, proto_tree *tree)
2848{
2849 tvbuff_t *next_tvb;
2850 bool_Bool update_col_info;
2851 proto_item *frag_tree_item;
2852
2853 if (fd_head != NULL((void*)0) && pinfo->num == fd_head->reassembled_in && pinfo->curr_layer_num == fd_head->reas_in_layer_num) {
2854 /*
2855 * OK, we've reassembled this.
2856 * Is this something that's been reassembled from more
2857 * than one fragment?
2858 */
2859 if (fd_head->next != NULL((void*)0)) {
2860 /*
2861 * Yes.
2862 * Allocate a new tvbuff, referring to the
2863 * reassembled payload, and set
2864 * the tvbuff to the list of tvbuffs to which
2865 * the tvbuff we were handed refers, so it'll get
2866 * cleaned up when that tvbuff is cleaned up.
2867 */
2868 next_tvb = tvb_new_chain(tvb, fd_head->tvb_data);
2869
2870 /* Add the defragmented data to the data source list. */
2871 add_new_data_source(pinfo, next_tvb, name);
2872
2873 /* show all fragments */
2874 if (fd_head->flags & FD_BLOCKSEQUENCE0x0100) {
2875 update_col_info = !show_fragment_seq_tree(
2876 fd_head, fit, tree, pinfo, next_tvb, &frag_tree_item);
2877 } else {
2878 update_col_info = !show_fragment_tree(fd_head,
2879 fit, tree, pinfo, next_tvb, &frag_tree_item);
2880 }
2881 } else {
2882 /*
2883 * No.
2884 * Return a tvbuff with the payload. next_tvb ist from offset until end
2885 */
2886 next_tvb = tvb_new_subset_remaining(tvb, offset);
2887 pinfo->fragmented = false0; /* one-fragment packet */
2888 update_col_info = true1;
2889 }
2890 if (update_col_infop != NULL((void*)0))
2891 *update_col_infop = update_col_info;
2892 } else {
2893 /*
2894 * We don't have the complete reassembled payload, or this
2895 * isn't the final frame of that payload.
2896 */
2897 next_tvb = NULL((void*)0);
2898
2899 /*
2900 * If we know what frame this was reassembled in,
2901 * and if there's a field to use for the number of
2902 * the frame in which the packet was reassembled,
2903 * add it to the protocol tree.
2904 */
2905 if (fd_head != NULL((void*)0) && fit->hf_reassembled_in != NULL((void*)0)) {
2906 proto_item *fei = proto_tree_add_uint(tree,
2907 *(fit->hf_reassembled_in), tvb,
2908 0, 0, fd_head->reassembled_in);
2909 proto_item_set_generated(fei);
2910 }
2911 }
2912 return next_tvb;
2913}
2914
2915/*
2916 * Show a single fragment in a fragment subtree, and put information about
2917 * it in the top-level item for that subtree.
2918 */
2919static void
2920show_fragment(fragment_item *fd, const int offset, const fragment_items *fit,
2921 proto_tree *ft, proto_item *fi, const bool_Bool first_frag,
2922 const uint32_t count, tvbuff_t *tvb, packet_info *pinfo)
2923{
2924 proto_item *fei=NULL((void*)0);
2925 int hf;
2926
2927 if (first_frag) {
2928 char *name;
2929 if (count == 1) {
2930 name = g_strdup(proto_registrar_get_name(*(fit->hf_fragment)))g_strdup_inline (proto_registrar_get_name(*(fit->hf_fragment
)))
;
2931 } else {
2932 name = g_strdup(proto_registrar_get_name(*(fit->hf_fragments)))g_strdup_inline (proto_registrar_get_name(*(fit->hf_fragments
)))
;
2933 }
2934 proto_item_set_text(fi, "%u %s (%u byte%s): ", count, name, tvb_captured_length(tvb),
2935 plurality(tvb_captured_length(tvb), "", "s")((tvb_captured_length(tvb)) == 1 ? ("") : ("s")));
2936 g_free(name);
2937 } else {
2938 proto_item_append_text(fi, ", ");
2939 }
2940 proto_item_append_text(fi, "#%u(%u)", fd->frame, fd->len);
2941
2942 if (fd->flags & (FD_OVERLAPCONFLICT0x0004
2943 |FD_MULTIPLETAILS0x0008|FD_TOOLONGFRAGMENT0x0010) ) {
2944 hf = *(fit->hf_fragment_error);
2945 } else {
2946 hf = *(fit->hf_fragment);
2947 }
2948 if (fd->len == 0) {
2949 fei = proto_tree_add_uint_format(ft, hf,
2950 tvb, offset, fd->len,
2951 fd->frame,
2952 "Frame: %u (no data)",
2953 fd->frame);
2954 } else {
2955 fei = proto_tree_add_uint_format(ft, hf,
2956 tvb, offset, fd->len,
2957 fd->frame,
2958 "Frame: %u, payload: %u-%u (%u byte%s)",
2959 fd->frame,
2960 offset,
2961 offset+fd->len-1,
2962 fd->len,
2963 plurality(fd->len, "", "s")((fd->len) == 1 ? ("") : ("s")));
2964 }
2965 proto_item_set_generated(fei);
2966 mark_frame_as_depended_upon(pinfo->fd, fd->frame);
2967 if (fd->flags & (FD_OVERLAP0x0002|FD_OVERLAPCONFLICT0x0004
2968 |FD_MULTIPLETAILS0x0008|FD_TOOLONGFRAGMENT0x0010) ) {
2969 /* this fragment has some flags set, create a subtree
2970 * for it and display the flags.
2971 */
2972 proto_tree *fet=NULL((void*)0);
2973
2974 fet = proto_item_add_subtree(fei, *(fit->ett_fragment));
2975 if (fd->flags&FD_OVERLAP0x0002) {
2976 fei=proto_tree_add_boolean(fet,
2977 *(fit->hf_fragment_overlap),
2978 tvb, 0, 0,
2979 true1);
2980 proto_item_set_generated(fei);
2981 }
2982 if (fd->flags&FD_OVERLAPCONFLICT0x0004) {
2983 fei=proto_tree_add_boolean(fet,
2984 *(fit->hf_fragment_overlap_conflict),
2985 tvb, 0, 0,
2986 true1);
2987 proto_item_set_generated(fei);
2988 }
2989 if (fd->flags&FD_MULTIPLETAILS0x0008) {
2990 fei=proto_tree_add_boolean(fet,
2991 *(fit->hf_fragment_multiple_tails),
2992 tvb, 0, 0,
2993 true1);
2994 proto_item_set_generated(fei);
2995 }
2996 if (fd->flags&FD_TOOLONGFRAGMENT0x0010) {
2997 fei=proto_tree_add_boolean(fet,
2998 *(fit->hf_fragment_too_long_fragment),
2999 tvb, 0, 0,
3000 true1);
3001 proto_item_set_generated(fei);
3002 }
3003 }
3004}
3005
3006static bool_Bool
3007show_fragment_errs_in_col(fragment_head *fd_head, const fragment_items *fit,
3008 packet_info *pinfo)
3009{
3010 if (fd_head->flags & (FD_OVERLAPCONFLICT0x0004
3011 |FD_MULTIPLETAILS0x0008|FD_TOOLONGFRAGMENT0x0010) ) {
3012 col_add_fstr(pinfo->cinfo, COL_INFO, "[Illegal %s]", fit->tag);
3013 return true1;
3014 }
3015
3016 return false0;
3017}
3018
3019/* This function will build the fragment subtree; it's for fragments
3020 reassembled with "fragment_add()".
3021
3022 It will return true if there were fragmentation errors
3023 or false if fragmentation was ok.
3024*/
3025bool_Bool
3026show_fragment_tree(fragment_head *fd_head, const fragment_items *fit,
3027 proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, proto_item **fi)
3028{
3029 fragment_item *fd;
3030 proto_tree *ft;
3031 bool_Bool first_frag;
3032 uint32_t count = 0;
3033 /* It's not fragmented. */
3034 pinfo->fragmented = false0;
3035
3036 *fi = proto_tree_add_item(tree, *(fit->hf_fragments), tvb, 0, -1, ENC_NA0x00000000);
3037 proto_item_set_generated(*fi);
3038
3039 ft = proto_item_add_subtree(*fi, *(fit->ett_fragments));
3040 first_frag = true1;
3041 for (fd = fd_head->next; fd != NULL((void*)0); fd = fd->next) {
3042 count++;
3043 }
3044 for (fd = fd_head->next; fd != NULL((void*)0); fd = fd->next) {
3045 show_fragment(fd, fd->offset, fit, ft, *fi, first_frag, count, tvb, pinfo);
3046 first_frag = false0;
3047 }
3048
3049 if (fit->hf_fragment_count) {
3050 proto_item *fli = proto_tree_add_uint(ft, *(fit->hf_fragment_count),
3051 tvb, 0, 0, count);
3052 proto_item_set_generated(fli);
3053 }
3054
3055 if (fit->hf_reassembled_length) {
3056 proto_item *fli = proto_tree_add_uint(ft, *(fit->hf_reassembled_length),
3057 tvb, 0, 0, tvb_captured_length (tvb));
3058 proto_item_set_generated(fli);
3059 }
3060
3061 if (fit->hf_reassembled_data) {
3062 proto_item *fli = proto_tree_add_item(ft, *(fit->hf_reassembled_data),
3063 tvb, 0, tvb_captured_length(tvb), ENC_NA0x00000000);
3064 proto_item_set_generated(fli);
3065 }
3066
3067 return show_fragment_errs_in_col(fd_head, fit, pinfo);
3068}
3069
3070/* This function will build the fragment subtree; it's for fragments
3071 reassembled with "fragment_add_seq()" or "fragment_add_seq_check()".
3072
3073 It will return true if there were fragmentation errors
3074 or false if fragmentation was ok.
3075*/
3076bool_Bool
3077show_fragment_seq_tree(fragment_head *fd_head, const fragment_items *fit,
3078 proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, proto_item **fi)
3079{
3080 uint32_t offset, next_offset, count = 0;
3081 fragment_item *fd, *last_fd;
3082 proto_tree *ft;
3083 bool_Bool first_frag;
3084
3085 /* It's not fragmented. */
3086 pinfo->fragmented = false0;
3087
3088 *fi = proto_tree_add_item(tree, *(fit->hf_fragments), tvb, 0, -1, ENC_NA0x00000000);
3089 proto_item_set_generated(*fi);
3090
3091 ft = proto_item_add_subtree(*fi, *(fit->ett_fragments));
3092 offset = 0;
3093 next_offset = 0;
3094 last_fd = NULL((void*)0);
3095 first_frag = true1;
3096 for (fd = fd_head->next; fd != NULL((void*)0); fd = fd->next){
3097 count++;
3098 }
3099 for (fd = fd_head->next; fd != NULL((void*)0); fd = fd->next){
3100 if (last_fd == NULL((void*)0) || last_fd->offset != fd->offset) {
3101 offset = next_offset;
3102 next_offset += fd->len;
3103 }
3104 last_fd = fd;
3105 show_fragment(fd, offset, fit, ft, *fi, first_frag, count, tvb, pinfo);
3106 first_frag = false0;
3107 }
3108
3109 if (fit->hf_fragment_count) {
3110 proto_item *fli = proto_tree_add_uint(ft, *(fit->hf_fragment_count),
3111 tvb, 0, 0, count);
3112 proto_item_set_generated(fli);
3113 }
3114
3115 if (fit->hf_reassembled_length) {
3116 proto_item *fli = proto_tree_add_uint(ft, *(fit->hf_reassembled_length),
3117 tvb, 0, 0, tvb_captured_length (tvb));
3118 proto_item_set_generated(fli);
3119 }
3120
3121 if (fit->hf_reassembled_data) {
3122 proto_item *fli = proto_tree_add_item(ft, *(fit->hf_reassembled_data),
3123 tvb, 0, tvb_captured_length(tvb), ENC_NA0x00000000);
3124 proto_item_set_generated(fli);
3125 }
3126
3127 return show_fragment_errs_in_col(fd_head, fit, pinfo);
3128}
3129
3130static void
3131reassembly_table_init_reg_table(void *p, void *user_data _U___attribute__((unused)))
3132{
3133 register_reassembly_table_t* reg_table = (register_reassembly_table_t*)p;
3134 reassembly_table_init(reg_table->table, reg_table->funcs);
3135}
3136
3137static void
3138reassembly_table_init_reg_tables(void)
3139{
3140 g_list_foreach(reassembly_table_list, reassembly_table_init_reg_table, NULL((void*)0));
3141}
3142
3143static void
3144reassembly_table_cleanup_reg_table(void *p, void *user_data _U___attribute__((unused)))
3145{
3146 register_reassembly_table_t* reg_table = (register_reassembly_table_t*)p;
3147 reassembly_table_destroy(reg_table->table);
3148}
3149
3150static void
3151reassembly_table_cleanup_reg_tables(void)
3152{
3153 g_list_foreach(reassembly_table_list, reassembly_table_cleanup_reg_table, NULL((void*)0));
3154}
3155
3156void reassembly_tables_init(void)
3157{
3158 register_init_routine(&reassembly_table_init_reg_tables);
3159 register_cleanup_routine(&reassembly_table_cleanup_reg_tables);
3160}
3161
3162static void
3163reassembly_table_free(void *p, void *user_data _U___attribute__((unused)))
3164{
3165 register_reassembly_table_t* reg_table = (register_reassembly_table_t*)p;
3166 reassembly_table_destroy(reg_table->table);
3167 g_free(reg_table);
3168}
3169
3170void
3171reassembly_table_cleanup(void)
3172{
3173 g_list_foreach(reassembly_table_list, reassembly_table_free, NULL((void*)0));
3174 g_list_free(reassembly_table_list);
3175}
3176
3177/* One instance of this structure is created for each pdu that spans across
3178 * multiple segments. (MSP) */
3179typedef struct _multisegment_pdu_t {
3180 uint64_t first_frame;
3181 uint64_t last_frame;
3182 unsigned start_offset_at_first_frame;
3183 unsigned end_offset_at_last_frame;
3184 int length; /* length of this MSP */
3185 uint32_t streaming_reassembly_id;
3186 /* pointer to previous multisegment_pdu */
3187 struct _multisegment_pdu_t* prev_msp;
3188} multisegment_pdu_t;
3189
3190/* struct for keeping the reassembly information of each stream */
3191struct streaming_reassembly_info_t {
3192 /* This map is keyed by frame num and keeps track of all MSPs for this
3193 * stream. Different frames will point to the same MSP if they contain
3194 * part data of this MSP. If a frame contains data that
3195 * belongs to two MSPs, it will point to the second MSP. */
3196 wmem_map_t* multisegment_pdus;
3197 /* This map is keyed by frame num and keeps track of the frag_offset
3198 * of the first byte of frames for fragment_add() after first scan. */
3199 wmem_map_t* frame_num_frag_offset_map;
3200 /* how many bytes the current uncompleted MSP still needs. (only valid for first scan) */
3201 int prev_deseg_len;
3202 /* the current uncompleted MSP (only valid for first scan) */
3203 multisegment_pdu_t* last_msp;
3204};
3205
3206static uint32_t
3207create_streaming_reassembly_id(void)
3208{
3209 static uint32_t global_streaming_reassembly_id = 0;
3210 return ++global_streaming_reassembly_id;
3211}
3212
3213streaming_reassembly_info_t*
3214streaming_reassembly_info_new(void)
3215{
3216 return wmem_new0(wmem_file_scope(), streaming_reassembly_info_t)((streaming_reassembly_info_t*)wmem_alloc0((wmem_file_scope()
), sizeof(streaming_reassembly_info_t)))
;
3217}
3218
3219/* Following is an example of ProtoA and ProtoB protocols from the declaration of this function in 'reassemble.h':
3220 *
3221 * +------------------ A Multisegment PDU of ProtoB ----------------------+
3222 * | |
3223 * +--- ProtoA payload1 ---+ +- payload2 -+ +- Payload3 -+ +- Payload4 -+ +- ProtoA payload5 -+
3224 * | EoMSP | OmNFP | BoMSP | | MoMSP | | MoMSP | | MoMSP | | EoMSP | BoMSP |
3225 * +-------+-------+-------+ +------------+ +------------+ +------------+ +---------+---------+
3226 * | |
3227 * +----------------------------------------------------------------------+
3228 *
3229 * For a ProtoA payload composed of EoMSP + OmNFP + BoMSP will call fragment_add() twice on EoMSP and BoMSP; and call
3230 * process_reassembled_data() once for generating tvb of a MSP to which EoMSP belongs; and call subdissector twice on
3231 * reassembled MSP of EoMSP and OmNFP + BoMSP. After that finds BoMSP is a beginning of a MSP at first scan.
3232 *
3233 * The rules are:
3234 *
3235 * - If a ProtoA payload contains EoMSP, we will need call fragment_add(), process_reassembled_data() and subdissector
3236 * once on it to end a MSP. (May run twice or more times at first scan, because subdissector may only return the
3237 * head length of message by pinfo->desegment_len. We need run second time for subdissector to determine the length
3238 * of entire message).
3239 *
3240 * - If a ProtoA payload contains OmNFP, we will need only call subdissector once on it. The subdissector need dissect
3241 * all non-fragment PDUs in it. (no desegment_len should output)
3242 *
3243 * - If a ProtoA payload contains BoMSP, we will need call subdissector once on BoMSP or OmNFP+BoMSP (because unknown
3244 * during first scan). The subdissector will output desegment_len (!= 0). Then we will call fragment_add()
3245 * with a new reassembly id on BoMSP for starting a new MSP.
3246 *
3247 * - If a ProtoA payload only contains MoMSP (entire payload is part of a MSP), we will only call fragment_add() once
3248 * or twice (at first scan) on it. The subdissector will not be called.
3249 *
3250 * In this implementation, only multisegment PDUs are recorded in multisegment_pdus map keyed by the numbers (uint64_t)
3251 * of frames belongs to MSPs. Each MSP in the map has a pointer referred to previous MSP, because we may need
3252 * two MSPs to dissect a ProtoA payload that contains EoMSP + BoMSP at the same time. The multisegment_pdus map is built
3253 * during first scan (pinfo->visited == false) with help of prev_deseg_len and last_msp fields of streaming_reassembly_info_t
3254 * for each direction of a ProtoA STREAM. The prev_deseg_len record how many bytes of subsequent ProtoA payloads belong to
3255 * previous PDU during first scan. The last_msp member of streaming_reassembly_info_t is always point to last MSP which
3256 * is created during scan previous or early ProtoA payloads. Since subdissector might return only the head length of entire
3257 * message (by pinfo->desegment_len) when there is not enough data to determine the message length, we need to reopen
3258 * reassembly fragments for adding more bytes during scanning the next ProtoA payload. We have to use fragment_add()
3259 * instead of fragment_add_check() or fragment_add_seq_next().
3260 *
3261 * Read more: please refer to comments of the declaration of this function in 'reassemble.h'.
3262 */
3263int
3264reassemble_streaming_data_and_call_subdissector(
3265 tvbuff_t* tvb, packet_info* pinfo, unsigned offset, int length,
3266 proto_tree* segment_tree, proto_tree* reassembled_tree, reassembly_table streaming_reassembly_table,
3267 streaming_reassembly_info_t* reassembly_info, uint64_t cur_frame_num,
3268 dissector_handle_t subdissector_handle, proto_tree* subdissector_tree, void* subdissector_data,
3269 const char* label, const fragment_items* frag_hf_items, int hf_segment_data
3270)
3271{
3272 int orig_length = length;
3273 int datalen = 0;
3274 int bytes_belong_to_prev_msp = 0; /* bytes belong to previous MSP */
3275 uint32_t reassembly_id = 0, frag_offset = 0;
3276 fragment_head* head = NULL((void*)0);
3277 bool_Bool need_more = false0;
3278 bool_Bool found_BoMSP = false0;
3279 multisegment_pdu_t* cur_msp = NULL((void*)0), * prev_msp = NULL((void*)0);
3280 uint16_t save_can_desegment;
3281 int save_desegment_offset;
3282 uint32_t save_desegment_len;
3283 uint64_t* frame_ptr;
3284
3285 save_can_desegment = pinfo->can_desegment;
3286 save_desegment_offset = pinfo->desegment_offset;
3287 save_desegment_len = pinfo->desegment_len;
3288
3289 /* calculate how many bytes of this payload belongs to previous MSP (EoMSP) */
3290 if (!PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited)) {
3291 /* this is first scan */
3292 if (reassembly_info->prev_deseg_len == DESEGMENT_ONE_MORE_SEGMENT0x0fffffff) {
3293 /* assuming the entire tvb belongs to the previous MSP */
3294 bytes_belong_to_prev_msp = length;
3295 reassembly_info->prev_deseg_len = length;
3296 } else if (reassembly_info->prev_deseg_len > 0) {
3297 /* part or all of current payload belong to previous MSP */
3298 bytes_belong_to_prev_msp = MIN(reassembly_info->prev_deseg_len, length)(((reassembly_info->prev_deseg_len) < (length)) ? (reassembly_info
->prev_deseg_len) : (length))
;
3299 reassembly_info->prev_deseg_len -= bytes_belong_to_prev_msp;
3300 need_more = (reassembly_info->prev_deseg_len > 0);
3301 } /* else { beginning of a new PDU (might be a NFP or MSP) } */
3302
3303 if (bytes_belong_to_prev_msp > 0) {
3304 DISSECTOR_ASSERT(reassembly_info->last_msp != NULL)((void) ((reassembly_info->last_msp != ((void*)0)) ? (void
)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/reassemble.c", 3304, "reassembly_info->last_msp != ((void*)0)"
))))
;
3305 reassembly_id = reassembly_info->last_msp->streaming_reassembly_id;
3306 frag_offset = reassembly_info->last_msp->length;
3307 if (reassembly_info->frame_num_frag_offset_map == NULL((void*)0)) {
3308 reassembly_info->frame_num_frag_offset_map = wmem_map_new(wmem_file_scope(), g_int64_hash, g_int64_equal);
3309 }
3310 frame_ptr = (uint64_t*)wmem_memdup(wmem_file_scope(), &cur_frame_num, sizeof(uint64_t));
3311 wmem_map_insert(reassembly_info->frame_num_frag_offset_map, frame_ptr, GUINT_TO_POINTER(frag_offset)((gpointer) (gulong) (frag_offset)));
3312 /* This payload contains the data of previous msp, so we point to it. That may be overridden late. */
3313 wmem_map_insert(reassembly_info->multisegment_pdus, frame_ptr, reassembly_info->last_msp);
3314 }
3315 } else {
3316 /* not first scan, use information of multisegment_pdus built during first scan */
3317 if (reassembly_info->multisegment_pdus) {
3318 cur_msp = (multisegment_pdu_t*)wmem_map_lookup(reassembly_info->multisegment_pdus, &cur_frame_num);
3319 }
3320 if (cur_msp) {
3321 if (cur_msp->first_frame == cur_frame_num) {
3322 /* Current payload contains a beginning of a MSP. (BoMSP)
3323 * The cur_msp contains information about the beginning MSP.
3324 * If prev_msp is not null, that means this payload also contains
3325 * the last part of previous MSP. (EoMSP) */
3326 prev_msp = cur_msp->prev_msp;
3327 } else {
3328 /* Current payload is not a first frame of a MSP (not include BoMSP). */
3329 prev_msp = cur_msp;
3330 cur_msp = NULL((void*)0);
3331 }
3332 }
3333
3334 if (prev_msp && prev_msp->last_frame >= cur_frame_num) {
3335 if (prev_msp->last_frame == cur_frame_num) {
3336 /* this payload contains part of previous MSP (contains EoMSP) */
3337 bytes_belong_to_prev_msp = prev_msp->end_offset_at_last_frame - offset;
3338 } else { /* if (prev_msp->last_frame > cur_frame_num) */
3339 /* this payload all belongs to previous MSP */
3340 bytes_belong_to_prev_msp = length;
3341 need_more = true1;
3342 }
3343 reassembly_id = prev_msp->streaming_reassembly_id;
3344 }
3345 if (reassembly_info->frame_num_frag_offset_map) {
3346 frag_offset = GPOINTER_TO_UINT(wmem_map_lookup(reassembly_info->frame_num_frag_offset_map, &cur_frame_num))((guint) (gulong) (wmem_map_lookup(reassembly_info->frame_num_frag_offset_map
, &cur_frame_num)))
;
3347 }
3348 }
3349
3350 /* handling EoMSP or MoMSP (entire payload being middle part of a MSP) */
3351 while (bytes_belong_to_prev_msp > 0) {
3352 tvbuff_t* reassembled_tvb = NULL((void*)0);
3353 DISSECTOR_ASSERT(reassembly_id > 0)((void) ((reassembly_id > 0) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/reassemble.c", 3353,
"reassembly_id > 0"))))
;
3354 pinfo->can_desegment = 2; /* this will be decreased one while passing to subdissector */
3355 pinfo->desegment_offset = 0;
3356 pinfo->desegment_len = 0;
3357
3358 head = fragment_add(&streaming_reassembly_table, tvb, offset, pinfo, reassembly_id, NULL((void*)0),
3359 frag_offset, bytes_belong_to_prev_msp, need_more);
3360
3361 if (head) {
3362 if (frag_hf_items->hf_reassembled_in) {
3363 proto_item_set_generated(
3364 proto_tree_add_uint(segment_tree, *(frag_hf_items->hf_reassembled_in), tvb, offset,
3365 bytes_belong_to_prev_msp, head->reassembled_in)
3366 );
3367 }
3368
3369 if (!need_more) {
3370 reassembled_tvb = process_reassembled_data(tvb, offset, pinfo,
3371 wmem_strdup_printf(pinfo->pool, "Reassembled %s", label),
3372 head, frag_hf_items, NULL((void*)0), reassembled_tree);
3373 }
3374 }
3375
3376 proto_tree_add_bytes_format(segment_tree, hf_segment_data, tvb, offset,
3377 bytes_belong_to_prev_msp, NULL((void*)0), "%s Segment data (%u byte%s)", label,
3378 bytes_belong_to_prev_msp, plurality(bytes_belong_to_prev_msp, "", "s")((bytes_belong_to_prev_msp) == 1 ? ("") : ("s")));
3379
3380 if (reassembled_tvb) {
3381 /* normally, this stage will dissect one or more completed pdus */
3382 /* Note, don't call_dissector_with_data because sometime the pinfo->curr_layer_num will changed
3383 * after calling that will make reassembly failed! */
3384 call_dissector_only(subdissector_handle, reassembled_tvb, pinfo, subdissector_tree, subdissector_data);
3385 }
3386
3387 if (pinfo->desegment_len) {
3388 /* that must only happen during first scan the reassembly_info->prev_deseg_len might be only the
3389 * head length of entire message. */
3390 DISSECTOR_ASSERT(!PINFO_FD_VISITED(pinfo))((void) ((!((pinfo)->fd->visited)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/reassemble.c", 3390,
"!((pinfo)->fd->visited)"))))
;
3391 DISSECTOR_ASSERT_HINT(pinfo->desegment_len != DESEGMENT_UNTIL_FIN, "Subdissector MUST NOT "((void) ((pinfo->desegment_len != 0x0ffffffe) ? (void)0 : (
proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/reassemble.c", 3393, "pinfo->desegment_len != 0x0ffffffe"
, "Subdissector MUST NOT " "set pinfo->desegment_len to DESEGMENT_UNTIL_FIN. Instead, it can set pinfo->desegment_len to "
" DESEGMENT_ONE_MORE_SEGMENT or the length of head if the length of entire message is not able to be determined."
))))
3392 "set pinfo->desegment_len to DESEGMENT_UNTIL_FIN. Instead, it can set pinfo->desegment_len to "((void) ((pinfo->desegment_len != 0x0ffffffe) ? (void)0 : (
proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/reassemble.c", 3393, "pinfo->desegment_len != 0x0ffffffe"
, "Subdissector MUST NOT " "set pinfo->desegment_len to DESEGMENT_UNTIL_FIN. Instead, it can set pinfo->desegment_len to "
" DESEGMENT_ONE_MORE_SEGMENT or the length of head if the length of entire message is not able to be determined."
))))
3393 " DESEGMENT_ONE_MORE_SEGMENT or the length of head if the length of entire message is not able to be determined.")((void) ((pinfo->desegment_len != 0x0ffffffe) ? (void)0 : (
proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/reassemble.c", 3393, "pinfo->desegment_len != 0x0ffffffe"
, "Subdissector MUST NOT " "set pinfo->desegment_len to DESEGMENT_UNTIL_FIN. Instead, it can set pinfo->desegment_len to "
" DESEGMENT_ONE_MORE_SEGMENT or the length of head if the length of entire message is not able to be determined."
))))
;
3394
3395 if (pinfo->desegment_offset > 0) {
3396 DISSECTOR_ASSERT_HINT(pinfo->desegment_offset > reassembly_info->last_msp->length((void) ((pinfo->desegment_offset > reassembly_info->
last_msp->length && pinfo->desegment_offset <
reassembly_info->last_msp->length + bytes_belong_to_prev_msp
) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/reassemble.c", 3400, "pinfo->desegment_offset > reassembly_info->last_msp->length && pinfo->desegment_offset < reassembly_info->last_msp->length + bytes_belong_to_prev_msp"
, wmem_strdup_printf(pinfo->pool, "Subdissector MUST NOT set pinfo->desegment_offset(%d) in previous or next part of MSP, must between (%d, %d)."
, pinfo->desegment_offset, reassembly_info->last_msp->
length, reassembly_info->last_msp->length + bytes_belong_to_prev_msp
)))))
3397 && pinfo->desegment_offset < reassembly_info->last_msp->length + bytes_belong_to_prev_msp,((void) ((pinfo->desegment_offset > reassembly_info->
last_msp->length && pinfo->desegment_offset <
reassembly_info->last_msp->length + bytes_belong_to_prev_msp
) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/reassemble.c", 3400, "pinfo->desegment_offset > reassembly_info->last_msp->length && pinfo->desegment_offset < reassembly_info->last_msp->length + bytes_belong_to_prev_msp"
, wmem_strdup_printf(pinfo->pool, "Subdissector MUST NOT set pinfo->desegment_offset(%d) in previous or next part of MSP, must between (%d, %d)."
, pinfo->desegment_offset, reassembly_info->last_msp->
length, reassembly_info->last_msp->length + bytes_belong_to_prev_msp
)))))
3398 wmem_strdup_printf(pinfo->pool,((void) ((pinfo->desegment_offset > reassembly_info->
last_msp->length && pinfo->desegment_offset <
reassembly_info->last_msp->length + bytes_belong_to_prev_msp
) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/reassemble.c", 3400, "pinfo->desegment_offset > reassembly_info->last_msp->length && pinfo->desegment_offset < reassembly_info->last_msp->length + bytes_belong_to_prev_msp"
, wmem_strdup_printf(pinfo->pool, "Subdissector MUST NOT set pinfo->desegment_offset(%d) in previous or next part of MSP, must between (%d, %d)."
, pinfo->desegment_offset, reassembly_info->last_msp->
length, reassembly_info->last_msp->length + bytes_belong_to_prev_msp
)))))
3399 "Subdissector MUST NOT set pinfo->desegment_offset(%d) in previous or next part of MSP, must between (%d, %d).",((void) ((pinfo->desegment_offset > reassembly_info->
last_msp->length && pinfo->desegment_offset <
reassembly_info->last_msp->length + bytes_belong_to_prev_msp
) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/reassemble.c", 3400, "pinfo->desegment_offset > reassembly_info->last_msp->length && pinfo->desegment_offset < reassembly_info->last_msp->length + bytes_belong_to_prev_msp"
, wmem_strdup_printf(pinfo->pool, "Subdissector MUST NOT set pinfo->desegment_offset(%d) in previous or next part of MSP, must between (%d, %d)."
, pinfo->desegment_offset, reassembly_info->last_msp->
length, reassembly_info->last_msp->length + bytes_belong_to_prev_msp
)))))
3400 pinfo->desegment_offset, reassembly_info->last_msp->length, reassembly_info->last_msp->length + bytes_belong_to_prev_msp))((void) ((pinfo->desegment_offset > reassembly_info->
last_msp->length && pinfo->desegment_offset <
reassembly_info->last_msp->length + bytes_belong_to_prev_msp
) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/reassemble.c", 3400, "pinfo->desegment_offset > reassembly_info->last_msp->length && pinfo->desegment_offset < reassembly_info->last_msp->length + bytes_belong_to_prev_msp"
, wmem_strdup_printf(pinfo->pool, "Subdissector MUST NOT set pinfo->desegment_offset(%d) in previous or next part of MSP, must between (%d, %d)."
, pinfo->desegment_offset, reassembly_info->last_msp->
length, reassembly_info->last_msp->length + bytes_belong_to_prev_msp
)))))
;
3401
3402 /* shorten the bytes_belong_to_prev_msp and just truncate the reassembled tvb */
3403 bytes_belong_to_prev_msp = pinfo->desegment_offset - reassembly_info->last_msp->length;
3404 fragment_truncate(&streaming_reassembly_table, pinfo, reassembly_id, NULL((void*)0), pinfo->desegment_offset);
3405 found_BoMSP = true1;
3406 } else {
3407 if (pinfo->desegment_len == DESEGMENT_ONE_MORE_SEGMENT0x0fffffff) {
3408 /* just need more bytes, all remaining bytes belongs to previous MSP (to run fragment_add again) */
3409 bytes_belong_to_prev_msp = length;
3410 }
3411
3412 /* Remove the data added by previous fragment_add(), and reopen fragments for adding more bytes. */
3413 fragment_truncate(&streaming_reassembly_table, pinfo, reassembly_id, NULL((void*)0), reassembly_info->last_msp->length);
3414 fragment_set_partial_reassembly(&streaming_reassembly_table, pinfo, reassembly_id, NULL((void*)0));
3415
3416 reassembly_info->prev_deseg_len = bytes_belong_to_prev_msp + pinfo->desegment_len;
3417 bytes_belong_to_prev_msp = MIN(reassembly_info->prev_deseg_len, length)(((reassembly_info->prev_deseg_len) < (length)) ? (reassembly_info
->prev_deseg_len) : (length))
;
3418 reassembly_info->prev_deseg_len -= bytes_belong_to_prev_msp;
3419 need_more = (reassembly_info->prev_deseg_len > 0);
3420 continue;
3421 }
3422 }
3423
3424 if (pinfo->desegment_len == 0 || found_BoMSP) {
3425 /* We will arrive here, only when the MSP is defragmented and dissected or this
3426 * payload all belongs to previous MSP (only fragment_add() with need_more=true called)
3427 * or BoMSP is parsed while pinfo->desegment_offset > 0 and pinfo->desegment_len != 0
3428 */
3429 offset += bytes_belong_to_prev_msp;
3430 length -= bytes_belong_to_prev_msp;
3431 DISSECTOR_ASSERT(length >= 0)((void) ((length >= 0) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/reassemble.c", 3431,
"length >= 0"))))
;
3432 if (!PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited)) {
3433 reassembly_info->last_msp->length += bytes_belong_to_prev_msp;
3434 }
3435
3436 if (!PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited) && reassembled_tvb) {
3437 /* completed current msp */
3438 reassembly_info->last_msp->last_frame = cur_frame_num;
3439 reassembly_info->last_msp->end_offset_at_last_frame = offset;
3440 reassembly_info->prev_deseg_len = pinfo->desegment_len;
3441 }
3442 bytes_belong_to_prev_msp = 0; /* break */
3443 }
3444 }
3445
3446 /* to find and handle OmNFP, and find BoMSP at first scan. */
3447 if (length > 0 && !found_BoMSP) {
3448 if (!PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited)) {
3449 /* It is first scan, to dissect remaining bytes to find whether it is OmNFP only, or BoMSP only or OmNFP + BoMSP. */
3450 datalen = length;
3451 DISSECTOR_ASSERT(cur_msp == NULL)((void) ((cur_msp == ((void*)0)) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/reassemble.c", 3451,
"cur_msp == ((void*)0)"))))
;
3452 } else {
3453 /* Not first scan */
3454 if (cur_msp) {
3455 /* There's a BoMSP. Let's calculate the length of OmNFP between EoMSP and BoMSP */
3456 datalen = cur_msp->start_offset_at_first_frame - offset; /* if result is zero that means no OmNFP */
3457 } else {
3458 /* This payload is not a beginning of MSP. The remaining bytes all belong to OmNFP without BoMSP */
3459 datalen = length;
3460 }
3461 }
3462 DISSECTOR_ASSERT(datalen >= 0)((void) ((datalen >= 0) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/reassemble.c", 3462,
"datalen >= 0"))))
;
3463
3464 /* Dissect the remaining of this payload. If (datalen == 0) means remaining only have one BoMSP without OmNFP. */
3465 if (datalen > 0) {
3466 /* we dissect if it is not dissected before or it is a non-fragment pdu (between two multisegment pdus) */
3467 pinfo->can_desegment = 2;
3468 pinfo->desegment_offset = 0;
3469 pinfo->desegment_len = 0;
3470
3471 call_dissector_only(subdissector_handle, tvb_new_subset_length(tvb, offset, datalen),
3472 pinfo, subdissector_tree, subdissector_data);
3473
3474 if (pinfo->desegment_len) {
3475 DISSECTOR_ASSERT_HINT(pinfo->desegment_len != DESEGMENT_UNTIL_FIN, "Subdissector MUST NOT "((void) ((pinfo->desegment_len != 0x0ffffffe) ? (void)0 : (
proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/reassemble.c", 3477, "pinfo->desegment_len != 0x0ffffffe"
, "Subdissector MUST NOT " "set pinfo->desegment_len to DESEGMENT_UNTIL_FIN. Instead, it can set pinfo->desegment_len to "
" DESEGMENT_ONE_MORE_SEGMENT or the length of head if the length of entire message is not able to be determined."
))))
3476 "set pinfo->desegment_len to DESEGMENT_UNTIL_FIN. Instead, it can set pinfo->desegment_len to "((void) ((pinfo->desegment_len != 0x0ffffffe) ? (void)0 : (
proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/reassemble.c", 3477, "pinfo->desegment_len != 0x0ffffffe"
, "Subdissector MUST NOT " "set pinfo->desegment_len to DESEGMENT_UNTIL_FIN. Instead, it can set pinfo->desegment_len to "
" DESEGMENT_ONE_MORE_SEGMENT or the length of head if the length of entire message is not able to be determined."
))))
3477 " DESEGMENT_ONE_MORE_SEGMENT or the length of head if the length of entire message is not able to be determined.")((void) ((pinfo->desegment_len != 0x0ffffffe) ? (void)0 : (
proto_report_dissector_bug("%s:%u: failed assertion \"%s\" (%s)"
, "epan/reassemble.c", 3477, "pinfo->desegment_len != 0x0ffffffe"
, "Subdissector MUST NOT " "set pinfo->desegment_len to DESEGMENT_UNTIL_FIN. Instead, it can set pinfo->desegment_len to "
" DESEGMENT_ONE_MORE_SEGMENT or the length of head if the length of entire message is not able to be determined."
))))
;
3478 /* only happen during first scan */
3479 DISSECTOR_ASSERT(!PINFO_FD_VISITED(pinfo) && datalen == length)((void) ((!((pinfo)->fd->visited) && datalen ==
length) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/reassemble.c", 3479, "!((pinfo)->fd->visited) && datalen == length"
))))
;
3480 offset += pinfo->desegment_offset;
3481 length -= pinfo->desegment_offset;
3482 } else {
3483 /* all remaining bytes are consumed by subdissector */
3484 offset += datalen;
3485 length -= datalen;
3486 }
3487 if (!PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited)) {
3488 reassembly_info->prev_deseg_len = pinfo->desegment_len;
3489 }
3490 } /* else all remaining bytes (BoMSP) belong to a new MSP */
3491 DISSECTOR_ASSERT(length >= 0)((void) ((length >= 0) ? (void)0 : (proto_report_dissector_bug
("%s:%u: failed assertion \"%s\"", "epan/reassemble.c", 3491,
"length >= 0"))))
;
3492 }
3493
3494 /* handling BoMSP */
3495 if (length > 0) {
3496 col_append_sep_fstr(pinfo->cinfo, COL_INFO, " ", "[%s segment of a reassembled PDU] ", label);
3497 if (!PINFO_FD_VISITED(pinfo)((pinfo)->fd->visited)) {
3498 /* create a msp for current frame during first scan */
3499 cur_msp = wmem_new0(wmem_file_scope(), multisegment_pdu_t)((multisegment_pdu_t*)wmem_alloc0((wmem_file_scope()), sizeof
(multisegment_pdu_t)))
;
3500 cur_msp->first_frame = cur_frame_num;
3501 cur_msp->last_frame = UINT64_MAX(18446744073709551615UL);
3502 cur_msp->start_offset_at_first_frame = offset;
3503 cur_msp->length = length;
3504 cur_msp->streaming_reassembly_id = reassembly_id = create_streaming_reassembly_id();
3505 cur_msp->prev_msp = reassembly_info->last_msp;
3506 reassembly_info->last_msp = cur_msp;
3507 if (reassembly_info->multisegment_pdus == NULL((void*)0)) {
3508 reassembly_info->multisegment_pdus = wmem_map_new(wmem_file_scope(), g_int64_hash, g_int64_equal);
3509 }
3510 frame_ptr = (uint64_t*)wmem_memdup(wmem_file_scope(), &cur_frame_num, sizeof(uint64_t));
3511 wmem_map_insert(reassembly_info->multisegment_pdus, frame_ptr, cur_msp);
3512 } else {
3513 DISSECTOR_ASSERT(cur_msp && cur_msp->start_offset_at_first_frame == offset)((void) ((cur_msp && cur_msp->start_offset_at_first_frame
== offset) ? (void)0 : (proto_report_dissector_bug("%s:%u: failed assertion \"%s\""
, "epan/reassemble.c", 3513, "cur_msp && cur_msp->start_offset_at_first_frame == offset"
))))
;
3514 reassembly_id = cur_msp->streaming_reassembly_id;
3515 }
3516 /* add first fragment of the new MSP to reassembly table */
3517 head = fragment_add(&streaming_reassembly_table, tvb, offset, pinfo, reassembly_id,
3518 NULL((void*)0), 0, length, true1);
3519
3520 if (head && frag_hf_items->hf_reassembled_in) {
3521 proto_item_set_generated(
3522 proto_tree_add_uint(segment_tree, *(frag_hf_items->hf_reassembled_in),
3523 tvb, offset, length, head->reassembled_in)
3524 );
3525 }
3526 proto_tree_add_bytes_format(segment_tree, hf_segment_data, tvb, offset, length,
3527 NULL((void*)0), "%s Segment data (%u byte%s)", label, length, plurality(length, "", "s")((length) == 1 ? ("") : ("s")));
3528 }
3529
3530 pinfo->can_desegment = save_can_desegment;
3531 pinfo->desegment_offset = save_desegment_offset;
3532 pinfo->desegment_len = save_desegment_len;
3533
3534 return orig_length;
3535}
3536
3537int
3538additional_bytes_expected_to_complete_reassembly(streaming_reassembly_info_t* reassembly_info)
3539{
3540 return reassembly_info->prev_deseg_len;
3541}
3542
3543/*
3544 * Editor modelines - https://www.wireshark.org/tools/modelines.html
3545 *
3546 * Local variables:
3547 * c-basic-offset: 8
3548 * tab-width: 8
3549 * indent-tabs-mode: t
3550 * End:
3551 *
3552 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
3553 * :indentSize=8:tabSize=8:noTabs=false:
3554 */