Skip to content

wireshark

Suresoft-GLaDOS edited this page May 26, 2023 · 9 revisions

#1

Link : https://gitlab.com/wireshark/wireshark/commit/63b484c91a7368d1ba1fce4e652d32fe6bddea6e
Description: Copy->Value - don't zero pad hex values

At epan/ftypes/ftype-integer.c

@@ -420,32 +420,18 @@ char_repr_len(fvalue_t *fv _U_, ftrepr_t rtype _U_, int field_display _U_)
 static void
 uinteger_to_repr(fvalue_t *fv, ftrepr_t rtype _U_, int field_display, char *buf, unsigned int size)
 {
+	if (((field_display & 0xff) == BASE_HEX) || ((field_display & 0xff) == BASE_HEX_DEC))
-	if ((field_display == BASE_HEX) || (field_display == BASE_HEX_DEC))
 	{
 		/* This format perfectly fits into 11 bytes. */
 		*buf++ = '0';
 		*buf++ = 'x';
+		switch (fv->ftype->ftype) {
+		case FT_UINT8:
+			buf = guint8_to_hex(buf, fv->value.uinteger);
+			break;
+		case FT_UINT16:
+			buf = word_to_hex(buf, fv->value.uinteger);
+			break;
+		case FT_UINT24:
+			buf = guint8_to_hex(buf, (fv->value.uinteger & 0x00ff0000) >> 16);
+			buf = word_to_hex(buf, (fv->value.uinteger & 0x0000ffff));
+			break;
+		default:
+			buf = dword_to_hex(buf, fv->value.uinteger);
+			break;
+		}
-		buf = dword_to_hex(buf, fv->value.uinteger);
 		*buf++ = '\0';
 	}
 	else

Tags
#Invalid-condition #Omission #Multi-line #Modified

#2

Link : https://gitlab.com/wireshark/wireshark/commit/4a8da5fbde2b731aeba451735497b46361873282
Description: Fix crash on TvbRange:__tostring for a zero-length TVB

At epan/wslua/wslua_tvb.c

@@ -1399,13 +1399,9 @@ WSLUA_METAMETHOD TvbRange__tostring(lua_State* L) {
         return 0;
     }
+    if (tvbr->len == 0) {
+        lua_pushstring(L, "<EMPTY>");
+    } else {
+        str = tvb_bytes_to_str(NULL,tvbr->tvb->ws_tvb,tvbr->offset,tvbr->len);
+        lua_pushstring(L,str);
+        wmem_free(NULL, str);
+    }
-    str = tvb_bytes_to_str(NULL,tvbr->tvb->ws_tvb,tvbr->offset,tvbr->len);
-    lua_pushstring(L,str);
-    wmem_free(NULL, str);
     WSLUA_RETURN(1); /* A Lua hex string of the first 24 binary bytes in the `TvbRange`. */
 }

Tags
#Logical-error #Multi-line #Modified

#3

Link : https://gitlab.com/wireshark/wireshark/commit/89beba7ea6c4e53c53349d2dc730db6ff4644979
Description: Fix display of Fragment Offset field

At epan/dissectors/packet-ip.c

@@ -2604,7 +2604,7 @@ proto_register_ip(void)
     { &hf_ip_frag_offset,
       { "Fragment offset", "ip.frag_offset", FT_UINT16, BASE_DEC,
+        NULL, 0x0, FRAG_OFFSET_WIDTH_MSG(IP_OFFSET_WIDTH), HFILL }},
-        NULL, 0x1fff, FRAG_OFFSET_WIDTH_MSG(IP_OFFSET_WIDTH), HFILL }},
     { &hf_ip_ttl,
       { "Time to live", "ip.ttl", FT_UINT8, BASE_DEC,

Tags
#Etc #Single-line #Modified

#4

Link : https://gitlab.com/wireshark/wireshark/commit/3e9ce48d24242c891968f65ae5160e967e73cfa5
Description: Fix decryption of MFP enabled connections

At epan/crypt/dot11decrypt.c

@@ -328,8 +328,8 @@ Dot11DecryptCopyKey(PDOT11DECRYPT_SEC_ASSOCIATION sa, PDOT11DECRYPT_KEY_ITEM key
         key->KeyData.Wpa.Cipher = sa->wpa.cipher;
         if (sa->wpa.key_ver==DOT11DECRYPT_WPA_KEY_VER_NOT_CCMP)
             key->KeyType=DOT11DECRYPT_KEY_TYPE_TKIP;
+        else if (sa->wpa.key_ver == 0 || sa->wpa.key_ver == 3 ||
+                 sa->wpa.key_ver == DOT11DECRYPT_WPA_KEY_VER_AES_CCMP)
-        else if (sa->wpa.key_ver == DOT11DECRYPT_WPA_KEY_VER_AES_CCMP ||
-                sa->wpa.key_ver == 0)
         {
             switch (sa->wpa.cipher) {
                 case 1:
@@ -1588,9 +1588,7 @@ Dot11DecryptRsna4WHandshake(
                 memcpy(eapol, eapol_raw, tot_len);
                 /* From IEEE 802.11-2016 12.7.2 EAPOL-Key frames */
+                if (eapol_parsed->key_version == 0 || eapol_parsed->key_version == 3 ||
+                    eapol_parsed->key_version == DOT11DECRYPT_WPA_KEY_VER_AES_CCMP)
+                {
-                if (eapol_parsed->key_version == 0) {
                     /* PTK derivation is based on Authentication Key Management Type */
                     akm = eapol_parsed->akm;
                     cipher = eapol_parsed->cipher;
@@ -1600,9 +1598,10 @@ Dot11DecryptRsna4WHandshake(
                     akm = 2;
                     cipher = 2;
                     group_cipher = 2;
+                } else {
+                    DEBUG_PRINT_LINE("EAPOL key_version not supported", DEBUG_LEVEL_3);
+                    return DOT11DECRYPT_RET_NO_VALID_HANDSHAKE;
-                } else if (eapol_parsed->key_version  == DOT11DECRYPT_WPA_KEY_VER_AES_CCMP) {
-                        akm = eapol_parsed->akm;
-                        cipher = eapol_parsed->cipher;
-                        group_cipher = eapol_parsed->group_cipher;
                 }
                 /* derive the PTK from the BSSID, STA MAC, PMK, SNonce, ANonce */

Tags
#Invalid-condition #Multi-line #Modified

#5

Link : https://gitlab.com/wireshark/wireshark/commit/00fd41b61985286b728c6631d83a0cc82d037cb3
Description: Fix ek output with -j option

At epan/print.c

@@ -1367,10 +1367,8 @@ ek_write_attr(GSList *attr_instances, write_json_data *pdata)
                 && !ek_check_protocolfilter(pdata->filter, fi->hfinfo->abbrev)) {
                 /* print dummy field */
+                json_dumper_begin_object(pdata->dumper);
                 json_dumper_set_member_name(pdata->dumper, "filtered");
                 json_dumper_value_string(pdata->dumper, fi->hfinfo->abbrev);
+                json_dumper_end_object(pdata->dumper);
             } else {
                 ek_write_field_value(fi, pdata);
             }

Tags
#Omission #Multi-line #Added

#6

Link : https://gitlab.com/wireshark/wireshark/commit/c03011b906dfaad7ff25d7b6f284ee07f9aeffc1
Description: Handle unpadded data

At epan/wslua/wslua_byte_array.c

@@ -259,20 +259,14 @@ WSLUA_METHOD ByteArray_base64_decode(lua_State* L) {
     ByteArray ba = checkByteArray(L,1);
     ByteArray ba2;
     gchar *data;
+    gsize len = ba->len;
+    if ((len % 4) != 0) {
+        len += 4 - (len % 4);
+    }
-    gsize len;
     ba2 = g_byte_array_new();
     if (ba->len > 1) {
+        data = (gchar*)g_malloc(len + 1);
-        data = (gchar*)g_malloc(ba->len + 1);
         memcpy(data, ba->data, ba->len);
+        if (len > ba->len) {
+            memcpy(data + ba->len, "====", len - ba->len);
+        }
+        data[len] = '\0';
-        data[ba->len] = '\0';
         g_base64_decode_inplace(data, &len);
         g_byte_array_append(ba2, data, (int)len);

Tags
#Memory-error #Multi-line #Modified

Clone this wiki locally