USB: configuration descriptors marked as malformed when they're just truncated

This issue was migrated from bug 8264 in our old bug tracker.

Original bug information:

Reporter: Steve Magnani
Status: RESOLVED FIXED
Product: Wireshark
Component: Dissection engine (libwireshark)
OS: All
Platform: x86
Version: Git

Attachments:

usb_malformed_descrip.patch: Patch - implementation
test.pcap: Testcase

Steve Magnani said:

Created attachment 9879 Patch - implementation

Build Information: wireshark 1.9.0 (SVN Rev 47317 from /trunk)

Copyright 1998-2013 Gerald Combs <gerald@‍wireshark.org> and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GTK+ 2.24.13, with Cairo 1.10.2, with Pango 1.30.0, with GLib 2.32.4, with libpcap, with libz 1.2.5, with POSIX capabilities (Linux), without libnl, with SMI 0.4.8, with c-ares 1.7.5, with Lua 5.1, without Python, with GnuTLS 2.12.20, with Gcrypt 1.5.0, with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built Jan 15 2012 21:55:34), with AirPcap.

Running on Linux 3.6.11-5.fc17.x86_64, with locale en_US.utf8, with libpcap version 1.2.1, with libz 1.2.5, GnuTLS 2.12.20, Gcrypt 1.5.0, without AirPcap.

Built using gcc 4.7.2 20120921 (Red Hat 4.7.2-2).

Improve handling of truncated USB Configuration descriptors.

In contrast to other descriptor types, configuration descriptors have varying
lengths and may be quite long. This makes them much more prone to truncation
by a host that is cautious about reading large descriptors.

A real-world case has arisen where a host requests a partial configuration
descriptor of a USB webcam, and wireshark improperly reports that the response
is malformed.

Change configuration descriptor dissection to distinguish between truncation
induced by the host, which is not an error, and descriptor truncation or
reporting of invalid descriptor lengths by the device, which are.

This patch also relieves class-specific dissectors of the burden of checking
that the descriptor length and type fields are available, and that all the
bytes claimed by the descriptor length are also available.

added libwireshark versiondev labels

Steve Magnani said:

Created attachment 9880
Testcase

Frames 6,14,34: normal configuration descriptor "probe" to find total length

Frame 8: normal read of full configuration descriptor

Frame 20: partial read of configuration descriptor.
          This is the case that the existing code marked as Malformed,
          prompting this patch.

Frame 22: Same as frame 8 but the last descriptor was hacked to exercise
          code to mark the descriptor as malformed (illegal length that
          would exceed the total reported config descriptor length)

Frame 36: Same as frame 8 but the last descriptor was hacked to exercise
          code to mark the descriptor as malformed (illegal length of 1)

Evan Huus said:

Thanks for the patch Steve, committed in r47676.

closed