Gerhard Gappmeier wrote:
Hi Ulf,
here is an updated version of the OpcUa dissector with a changed
security layer.
I also attached a new capture file with more traffic for the regression
test.
Hi Gerhard!
Sorry for the delay!
I've had a look at your dissector now and unfortunately it lacks the
required robustness.
A fuzzed Sample.cap file (attached) crashed TShark and took a *very*
long time (2 mins) to load in WS.
Some points that I've seen immediately:
- you *must* end *every* value_string you use by a an ending sequence {
0, NULL }, otherwise unexpected values coming from the network will
result in an access violation, as the corresponding access functions
will run into the wrong memory areas
- e.g. opcua.c / g_szMessageTypes unnecessarily re-implements a
value_string - this bloats code size and complexity
Please have a look at http://wiki.wireshark.org/FuzzTesting to do some
more regression tests on your own ...
Regards, ULFL
Attachment:
editcap.out.1178362914
Description: Binary data