Wireshark-bugs: [Wireshark-bugs] [Bug 971] New: Facility IE dissection error in GSM_DTAP

From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Wed, 14 Jun 2006 03:57:56 +0000 (GMT)

http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=971

           Summary: Facility IE dissection error in GSM_DTAP
           Product: Wireshark
           Version: SVN
          Platform: PC
        OS/Version: Windows XP
            Status: NEW
          Severity: Minor
          Priority: Low
         Component: Wireshark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: palos@xxxxxxxxxxxxx


When Setup message contains facility IE which has a CallingName parameters,
decoding error occurs.

The text log is as follows.
No.     Time        Source                Destination           Protocol Info
      2 0.195429    192.168.10.11         192.168.10.20         RANAP   
id-DirectTransfer (DTAP) (CC) Setup [Malformed Packet]

Frame 2 (230 bytes on wire, 230 bytes captured)
    Arrival Time: May 22, 2006 18:01:55.324369000
    Time delta from previous packet: 0.195429000 seconds
    Time since reference or first frame: 0.195429000 seconds
    Frame Number: 2
    Packet Length: 230 bytes
    Capture Length: 230 bytes
    Frame is marked: False
    Protocols in frame: eth:ip:udp:lge_monitor:mtp3:sccp:ranap:gsm_a_dtap
    Coloring Rule Name: lge_mon
    Coloring Rule String: lge_monitor.dir == 0
Ethernet II, Src: Goldstar_73:3e:ef (00:40:5a:73:3e:ef), Dst: HewlettP_10:55:a2
(00:15:60:10:55:a2)
    Destination: HewlettP_10:55:a2 (00:15:60:10:55:a2)
        Address: HewlettP_10:55:a2 (00:15:60:10:55:a2)
        .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
        .... ..0. .... .... .... .... = Locally Administrated Address: This is
a FACTORY DEFAULT address
    Source: Goldstar_73:3e:ef (00:40:5a:73:3e:ef)
        Address: Goldstar_73:3e:ef (00:40:5a:73:3e:ef)
        .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
        .... ..0. .... .... .... .... = Locally Administrated Address: This is
a FACTORY DEFAULT address
    Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.11 (192.168.10.11), Dst: 192.168.10.20
(192.168.10.20)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 216
    Identification: 0xd134 (53556)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: UDP (0x11)
    Header checksum: 0x1371 [correct]
        Good: True
        Bad : False
    Source: 192.168.10.11 (192.168.10.11)
    Destination: 192.168.10.20 (192.168.10.20)
User Datagram Protocol, Src Port: 10000 (10000), Dst Port: 10000 (10000)
    Source port: 10000 (10000)
    Destination port: 10000 (10000)
    Length: 196
    Checksum: 0x3fba [correct]
LGE Monitor
    LGE Monitor PDU
    Direction: TX(Transmit Message Signaling Unit) (0)
    Protocol Identifier: MTP-3(Message Transfer Part 3) (0)
    Payload Length: 176
Message Transfer Part Level 3
    Service information octet
        11.. .... = Network indicator: Reserved for national use (0x03)
        ..00 .... = Spare: 0x00
        .... 0011 = Service indicator: SCCP (0x03)
    Routing label
        .... .... .... .... ..00 1000 1010 0000 = DPC: 0x000008a0
        .... 0100 0010 1000 00.. .... .... .... = OPC: 0x000010a0
        1110 .... .... .... .... .... .... .... = Signalling Link Selector: 14
Signalling Connection Control Part
    Message Type: Data Form 1 (0x06)
    Destination Local Reference: 0x040b00
    .... ...0 = More data: No more data (0x00)
    Pointer to first Mandatory Variable parameter: 1
Radio Access Network Application Part
    RANAP-PDU: initiatingMessage (0)
        initiatingMessage
            procedureCode: id-DirectTransfer (20)
            criticality: ignore (1)
            directTransfer
                protocolIEs: 2 items
                    Item 0
                        Item
                            id: id-NAS-PDU (16)
                            criticality: ignore (1)
                            id-NAS-PDU:
03050409A1B8198820156300881C72A17002010002011030...
GSM A-I/F DTAP - Setup
    Protocol Discriminator: Call Control; call related SS messages
        0... .... :  TI flag: allocated by sender
        .000 .... :  TIO: 0
        .... 0011 = Protocol discriminator: Call Control; call related SS
messages (3)
    Message Type Setup
    Bearer Capability 1 - (Unrestricted digital information)
        Element ID: 4
        Length: 9
        1... .... :  Extension: not extended
        .01. .... :  Radio channel requirement: Full rate support only MS
        ...0 .... :  Coding standard: GSM standardized coding
        .... 0... :  Transfer mode: circuit
        .... .001 :  Information transfer capability: Unrestricted digital
information
        Octet 4
            1... .... :  Extension: not extended
            .0.. .... :  Compression: data compression not allowed
            ..11 .... :  Structure: Unstructured
            .... 1... :  Duplex mode: Full
            .... .0.. :  Configuration: Point-to-point
            .... ..0. :  NIRR: No meaning is associated with this value
            .... ...0 :  Establishment: Demand
        Octet 5
            0... .... :  Extension: extended
            .00. .... :  Access Identity: Octet identifier
            ...1 1... :  Rate Adaption: Other rate adaption (see octet 5a)
            .... .001 :  Signalling Access Protocol: I.440/450
        Octet 5a
            1... .... :  Extension: not extended
            .00. .... :  Other ITC: Restricted digital information
            ...0 1... :  Other Rate Adaption: H.223 & H.245
            .... .000 :  Spare
        Octet 6
            0... .... :  Extension: extended
            .01. .... :  Layer 1 Identity: Octet identifier
            ...0 000. :  User information layer 1 protocol: Default layer 1
protocol
            .... ...0 :  Synchronous/asynchronous: Synchronous
        Octet 6a
            0... .... :  Extension: extended
            .0.. .... :  Number of Stop Bits: 1
            ..0. .... :  Negotiation: In-band negotiation not possible
            ...1 .... :  Number of data bits excluding parity bit if present: 8
            .... 0101 :  User rate: 9.6 kbit/s Recommendation X.1 and V.110
        Octet 6b
            0... .... :  Extension: extended
            .11. .... :  V.110/X.30 rate adaptation Intermediate rate: 16
kbit/s
            ...0 .... :  Network independent clock (NIC) on transmission (Tx):
does not require to send data with network independent clock
            .... 0... :  Network independent clock (NIC) on reception (Rx):
cannot accept data with network independent clock
            .... .011 :  Parity information: None
        Octet 6c
            0... .... :  Extension: extended
            .00. .... :  Connection element: Transparent
            ...0 0000 :  Modem type: None
        Octet 6d
            1... .... :  Extension: not extended
            .00. .... :  Other modem type: No other modem type specified in
this field
            ...0 1000 :  Fixed network user rate: 64.0 kbit/s bit transparent
    Facility
        Element ID: 28
        Length: 114
        10.. .... = Class: CONTEXT (2)
        ..1. .... = P/C: Constructed Encoding
        ...0 0001 = Tag: 1
        Length: 112
        component: invoke (1)
            invoke
                00.. .... = Class: UNIVERSAL (0)
                ..0. .... = P/C: Primitive Encoding
                ...0 0010 = Tag: INTEGER (2)
                Length: 1
                invokeID: 0
                opCode: localValue (0)
                    00.. .... = Class: UNIVERSAL (0)
                    ..0. .... = P/C: Primitive Encoding
                    ...0 0010 = Tag: INTEGER (2)
                    Length: 1
                    localValue: Notify SS (16)
                00.. .... = Class: UNIVERSAL (0)
                ..1. .... = P/C: Constructed Encoding
                ...1 0000 = Tag: SEQUENCE (16)
                Length: 104
                notifySS
                    10.. .... = Class: CONTEXT (2)
                    ..0. .... = P/C: Primitive Encoding
                    ...0 0001 = Tag: 1
                    Length: 1
                    ss-Code: cnap - calling name presentation (25)
                    10.. .... = Class: CONTEXT (2)
                    ..1. .... = P/C: Constructed Encoding
                    ...1 0100 = Tag: 20
                    Length: 99
                    nameIndicator
                        10.. .... = Class: CONTEXT (2)
                        ..1. .... = P/C: Constructed Encoding
                        ...0 0000 = Tag: 0
                        Length: 97
                        10.. .... = Class: CONTEXT (2)
                        ..1. .... = P/C: Constructed Encoding
                        ...0 0000 = Tag: 0
                        Length: 95
                        callingName: namePresentationAllowed (0)
                            namePresentationAllowed
                                10.. .... = Class: CONTEXT (2)
                                ..0. .... = P/C: Primitive Encoding
                                ...0 0000 = Tag: 0
                                Length: 1
[Malformed Packet: GSM DTAP]

0000  00 15 60 10 55 a2 00 40 5a 73 3e ef 08 00 45 00   ..`.U..@Zs>...E.
0010  00 d8 d1 34 00 00 40 11 13 71 c0 a8 0a 0b c0 a8   ...4..@..q......
0020  0a 14 27 10 27 10 00 c4 3f ba 00 00 00 00 00 00   ..'.'...?.......
0030  00 00 00 00 00 b0 c3 a0 08 28 e4 06 00 0b 04 00   .........(......
0040  01 a4 00 14 40 80 9f 00 00 02 00 10 40 80 92 80   ....@.......@...
0050  90 03 05 04 09 a1 b8 19 88 20 15 63 00 88 1c 72   ......... .c...r
0060  a1 70 02 01 00 02 01 10 30 68 81 01 19 b4 63 a0   .p......0h....c.
0070  61 a0 5f 80 01 8f 81 01 57 82 57 80 9e 49 0f 16   a._.....W.W..I..
0080  a1 d9 1b 20 a6 a1 a6 a1 a6 a1 a6 a1 2a 2e 27 2a   ... ........*.'*
0090  27 0f 0a 17 48 41 56 45 20 41 20 4e 49 43 45 20   '...HAVE A NICE 
00a0  44 41 59 0f 0a 20 20 1d c7 e0 ba b9 c7 d1 20 c7   DAY..  ....... .
00b0  cf b7 e7 0f 0a 1b 2e 2a 27 2e 2a 27 a6 a1 a6 a1   .......*'.*'....
00c0  a6 a1 a6 a1 16 a1 d9 8d 09 c1 c1 c0 ba 20 c7 cf   ............. ..
00d0  b7 e7 5c 08 21 83 10 20 29 91 04 f3 7c 03 88 90   ..\.!.. )...|...
00e0  a6 00 3b 40 01 00                                 ..;@..


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.