Skip to content

Infinite recurision in ans1/ber decoding #1639

@bsloane1650

Description

@bsloane1650

Brief description

Decoding some invalid ans/ber input results in infinite recursion instead of appropriate exception

Environment

  • Scapy version: 6d41839
  • Python version: 2.7.15rc1
  • Operating System: Ubuntu 18.04.1 LTS

How to reproduce

SNMP('0a\x02\x01\x00\x04\x06public\xa3T\x02\x02D\xd0\x02\x01\x00\x02\x01\x000H0F\x06\x08+\x06\x01\x02\x01\x01\x05\x00\x00\x03\x01\x02D\x00\x03\x01\x02D\x00\x03\x01\x02D\x00\x03\x01\x02D\x00\x03\x01\x02D\x00\x03\x01\x02D\x00\x03\x01\x02D\x00\x03\x01\x02D\x00\x03\x01\x02D\x00\x03\x01\x02D\x00\x03\x01\x02D\x00\x03\x01\x02D')

(This is test case 00017616 from the req-enc segment of the PROTOS SNMPv1 test suite https://www.ee.oulu.fi/roles/ouspg/PROTOS_Test-Suite_c06-snmpv1 ) There are other cases in that suite that trigger what appears to be the same bug.

Actual result

Traceback (most recent call last):
File "", line 1, in
File "scapy/base_classes.py", line 252, in call
i.init(*args, **kargs)
File "scapy/packet.py", line 138, in init
self.dissect(_pkt)
File "scapy/packet.py", line 806, in dissect
s = self.do_dissect(s)
File "scapy/asn1packet.py", line 33, in do_dissect
return self.ASN1_root.dissect(self, x)
File "scapy/asn1fields.py", line 378, in dissect
_, x = self.m2i(pkt, s)
File "scapy/asn1fields.py", line 370, in m2i
s = obj.dissect(pkt, s)
File "scapy/asn1fields.py", line 138, in dissect
v, s = self.m2i(pkt, s)
File "scapy/asn1fields.py", line 549, in m2i
return self.extract_packet(choice, s)
File "scapy/asn1fields.py", line 122, in extract_packet
c = cls(s)
File "scapy/base_classes.py", line 252, in call
i.init(*args, **kargs)
File "scapy/packet.py", line 138, in init
self.dissect(_pkt)
File "scapy/packet.py", line 806, in dissect
s = self.do_dissect(s)
File "scapy/asn1packet.py", line 33, in do_dissect
return self.ASN1_root.dissect(self, x)
File "scapy/asn1fields.py", line 378, in dissect
_, x = self.m2i(pkt, s)
File "scapy/asn1fields.py", line 370, in m2i
s = obj.dissect(pkt, s)
File "scapy/asn1fields.py", line 138, in dissect
v, s = self.m2i(pkt, s)
File "scapy/asn1fields.py", line 419, in m2i
c, s = self.extract_packet(self.cls, s)
File "scapy/asn1fields.py", line 122, in extract_packet
c = cls(s)
File "scapy/base_classes.py", line 252, in call
i.init(*args, **kargs)
File "scapy/packet.py", line 138, in init
self.dissect(_pkt)
File "scapy/packet.py", line 806, in dissect
s = self.do_dissect(s)
File "scapy/asn1packet.py", line 33, in do_dissect
return self.ASN1_root.dissect(self, x)
File "scapy/asn1fields.py", line 378, in dissect
_, x = self.m2i(pkt, s)
File "scapy/asn1fields.py", line 370, in m2i
s = obj.dissect(pkt, s)
File "scapy/asn1fields.py", line 138, in dissect
v, s = self.m2i(pkt, s)
File "scapy/asn1fields.py", line 101, in m2i
return codec.dec(s, context=self.context)
File "scapy/asn1/ber.py", line 266, in dec
return cls.do_dec(s, context, safe)
File "scapy/asn1/ber.py", line 261, in do_dec
return codec.dec(s, context, safe)
...
File "scapy/asn1/ber.py", line 261, in do_dec
return codec.dec(s, context, safe)
File "scapy/asn1/ber.py", line 266, in dec
return cls.do_dec(s, context, safe)
File "scapy/asn1/ber.py", line 261, in do_dec
return codec.dec(s, context, safe)
File "scapy/asn1/ber.py", line 266, in dec
return cls.do_dec(s, context, safe)
File "scapy/asn1/ber.py", line 255, in do_dec
if p not in context:
File "scapy/utils.py", line 734, in contains
return val in self.rdict
File "scapy/utils.py", line 711, in eq
return self._value == int(other)
RuntimeError: maximum recursion depth exceeded while calling a Python object

Expected result

Domain specific exception

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions