["Tarlovskij Eugene" <eugene@xxxxxxxxxxxx>]

Recently I have captured text MEGACO packet which crashed EPAN library.
Unfortunately, I am not able to reproduce and re-capture those packets by
Ethereal. 

Here is a packed which crashed MEGACO dissector:

4d 45 47 41 43 4f 2f 31 20 3c 63 6f 6d 70 61 6e  MEGACO/1 <compan
79 32 2e 63 6f 6d 3e 3a 32 39 34 34 0a 54 72 61  y2.com>:2944.Tra
6e 73 61 63 74 69 6f 6e 3d 36 34 33 38 7b 0a 09  nsaction=6438{..
43 6f 6e 74 65 78 74 3d 2a 7b 0a 09 09 41 75 64  Context=*{...Aud
69 74 56 61 6c 75 65 3d 75 73 65 72 5f 36 7b 41  itValue=user_6{A
75 64 69 74 7b 4d 65 64 69 61 7d 7d 0a 09 7d 0a  udit{Media}}..}.
7d 0a                                            }.

Textual representation of this packet: 

MEGACO/1 <company2.com>:2944
Transaction=6438{
    Context=*{
        AuditValue=user_6{Audit{Media}}
    }
}

I use EPAN sources version 0.99 downloaded from Ethereal website.
BoundsError exception is reported by tvb_format_text routine because
tokenlen parameter is less than (-1).

Invalid tokenlen comes from packet-megaco.c:1348, procedure
dissect_megaco_mediadescriptor	

    tvb_current_offset = tvb_find_guint8(tvb, tvb_previous_offset,
tvb_RBRKT, '=');

Dissector sees word "Media" and tries to find "=" after it.

I have discussed this issue with qualified engineer and it told me:
=======================
I've looked into the IETF document "draft-ietf-megaco-callflows-04.txt",
and it has the sample at pages 162-163.
      Context = 2 {AuditValue = EphA{
         Audit{Media, DigitMap, Events, Signals, Packages, Statistics
   }}

When we send the Transaction (request), Audit sends just a name of
descriptor (here the list of names) like "Media" token. The reply looks
differently:
   MEGACO/1 [209.110.59.34]:25000
   Reply = 1234 {
      Context = 2 {
   AuditValue = EphA {
             Media {
                 TerminationState { ServiceState = InService,
                        Buffer = OFF },
                Stream = 1 {
                    LocalControl { Mode = SendReceive,
                       nt/jit=40 },
                    Local {
   v=0
   o=- 2890844525 2890842816 IN IP4 209.110.59.34
   s=- 
   t= 00 
   c=IN IP4 209.110.59.33
   m=audio 30000 RTP/AVP  0
   a=ptime:30
                   },
and the MediaDescriptor parameters are replied (as the list, without
"=")

The ABNF syntax confirms it: MediaToken is never followed by "=", only "}"
or "{".
=======================

This situation looks like MEGACO dissector bug.

Please tell me am I right about it.

Eugene Tarlovskij


_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev