Wireshark · Wireshark-dev: Re: [Wireshark-dev] OpcUa update

[Ulf Lamping <ulf.lamping@xxxxxx>]

Gerhard Gappmeier wrote:
> Hi Ulf,
>
> here is an updated version of the OpcUa dissector with a changed
> security layer.
> I also attached a new capture file with more traffic for the regression
> test.
>
>   
Hi Gerhard!

Sorry for the delay!

I've had a look at your dissector now and unfortunately it lacks the 
required robustness.

A fuzzed Sample.cap file (attached) crashed TShark and took a *very* 
long time (2 mins) to load in WS.


Some points that I've seen immediately:
- you *must* end *every* value_string you use by a an ending sequence { 
0, NULL }, otherwise unexpected values coming from the network will 
result in an access violation, as the corresponding access functions 
will run into the wrong memory areas
- e.g. opcua.c / g_szMessageTypes unnecessarily re-implements a 
value_string - this bloats code size and complexity


Please have a look at http://wiki.wireshark.org/FuzzTesting to do some 
more regression tests on your own ...

Regards, ULFL

Attachment: editcap.out.1178362914
Description: Binary data