/* packet-h223.c

 * Routines for H.223 packet dissection

 * Copyright (c) 2004-5 MX Telecom Ltd <richardv@mxtelecom.com>

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

#include "config.h"

#include <epan/packet.h>

#include <epan/conversation.h>

#include <epan/exceptions.h>

#include <epan/expert.h>

#include <epan/stream.h>

#include <epan/golay.h>

#include <epan/show_exception.h>

#include <epan/asn1.h>

#include <wsutil/bitswap.h>

#include <wsutil/wslog.h>

#include "packet-h245.h"

#include "packet-iax2.h"

#include "packet-iax2.h"

/* #define DEBUG_H223 */

void proto_register_h223 (void);

void proto_reg_handoff_h223(void);

/* debug the mux-pdu defragmentation code. warning: verbose output! */

/* #define DEBUG_H223_FRAGMENTATION */

#define PROTO_TAG_H223 "H.223"

/* Wireshark ID of the H.223 protocol */

static int proto_h223;

static int proto_h223_bitswapped;

/* The following hf_* variables are used to hold the Wireshark IDs of

 * our header fields; they are filled out when we call

 * proto_register_field_array() in proto_register_h223()

 */

/* static int hf_h223_non_h223_data; */

static int hf_h223_mux_stuffing_pdu;

static int hf_h223_mux_pdu;

static int hf_h223_mux_header;

static int hf_h223_mux_rawhdr;

static int hf_h223_mux_correctedhdr;

static int hf_h223_mux_mc;

static int hf_h223_mux_mpl;

static int hf_h223_mux_deact;

static int hf_h223_mux_vc;

static int hf_h223_mux_extra;

static int hf_h223_mux_hdlc2;

static int hf_h223_mux_fragments;

static int hf_h223_mux_fragment;

static int hf_h223_mux_fragment_overlap;

static int hf_h223_mux_fragment_overlap_conflict;

static int hf_h223_mux_fragment_multiple_tails;

static int hf_h223_mux_fragment_too_long_fragment;

static int hf_h223_mux_fragment_error;

static int hf_h223_mux_fragment_count;

static int hf_h223_mux_reassembled_in;

static int hf_h223_mux_reassembled_length;

static int hf_h223_al_fragments;

static int hf_h223_al_fragment;

static int hf_h223_al_fragment_overlap;

static int hf_h223_al_fragment_overlap_conflict;

static int hf_h223_al_fragment_multiple_tails;

static int hf_h223_al_fragment_too_long_fragment;

static int hf_h223_al_fragment_error;

static int hf_h223_al_fragment_count;

static int hf_h223_al_reassembled_in;

static int hf_h223_al_reassembled_length;

static int hf_h223_al1;

static int hf_h223_al1_framed;

static int hf_h223_al2;

static int hf_h223_al2_sequenced;

static int hf_h223_al2_unsequenced;

static int hf_h223_al2_seqno;

static int hf_h223_al2_crc;

static int hf_h223_al2_crc_status;

static int hf_h223_al_payload;

/* These are the ids of the subtrees that we may be creating */

static int ett_h223;

static int ett_h223_non_h223_data;

static int ett_h223_mux_stuffing_pdu;

static int ett_h223_mux_pdu;

static int ett_h223_mux_header;

static int ett_h223_mux_deact;

static int ett_h223_mux_vc;

static int ett_h223_mux_extra;

static int ett_h223_mux_fragments;

static int ett_h223_mux_fragment;

static int ett_h223_al_fragments;

static int ett_h223_al_fragment;

static int ett_h223_al1;

static int ett_h223_al2;

static int ett_h223_al_payload;

static expert_field ei_h223_al2_crc;

/* These are the handles of our subdissectors */

static dissector_handle_t data_handle;

static dissector_handle_t srp_handle;

static dissector_handle_t h223_bitswapped;

static const fragment_items h223_mux_frag_items _U_ = {

    &ett_h223_mux_fragment,

    &ett_h223_mux_fragments,

    &hf_h223_mux_fragments,

    &hf_h223_mux_fragment,

    &hf_h223_mux_fragment_overlap,

    &hf_h223_mux_fragment_overlap_conflict,

    &hf_h223_mux_fragment_multiple_tails,

    &hf_h223_mux_fragment_too_long_fragment,

    &hf_h223_mux_fragment_error,

    &hf_h223_mux_fragment_count,

    &hf_h223_mux_reassembled_in,

    &hf_h223_mux_reassembled_length,

    /* Reassembled data field */

    NULL,

    "fragments"

};

static const fragment_items h223_al_frag_items = {

    &ett_h223_al_fragment,

    &ett_h223_al_fragments,

    &hf_h223_al_fragments,

    &hf_h223_al_fragment,

    &hf_h223_al_fragment_overlap,

    &hf_h223_al_fragment_overlap_conflict,

    &hf_h223_al_fragment_multiple_tails,

    &hf_h223_al_fragment_too_long_fragment,

    &hf_h223_al_fragment_error,

    &hf_h223_al_fragment_count,

    &hf_h223_al_reassembled_in,

    &hf_h223_al_reassembled_length,

    /* Reassembled data field */

    NULL,

    "fragments"

};

/* this is a fudge to pass pdu_offset into add_h223_mux_element() */

static uint32_t pdu_offset;

/***************************************************************************

 *

 * virtual circuit number handling

 *

 * we have to be able to manage more than one H.223 call at a time,

 * so have a hash which maps {call,vc} to an integer.

 */

typedef struct _h223_call_info h223_call_info;

typedef struct {

    const h223_call_info* call; /* h223 call */

    uint32_t vc;                 /* child circuit */

} circuit_chain_key;

static wmem_map_t *circuit_chain_hashtable;

static unsigned circuit_chain_count = 1;

/* Hash Functions */

static int

circuit_chain_equal(const void *v, const void *w)

{

    const circuit_chain_key *v1 = (const circuit_chain_key *)v;

    const circuit_chain_key *v2 = (const circuit_chain_key *)w;

    int result;

    result = ( v1->call == v2->call &&

               v1->vc == v2 -> vc );

    return result;

}

static unsigned

circuit_chain_hash (const void *v)

{

    const circuit_chain_key *key = (const circuit_chain_key *)v;

  unsigned hash_val = (GPOINTER_TO_UINT(key->call)) ^ (((uint32_t)key->vc) << 16);

    return hash_val;

}

static uint32_t

circuit_chain_lookup(const h223_call_info* call_info, uint32_t child_vc)

{

    circuit_chain_key key, *new_key;

    uint32_t circuit_id;

    key.call = call_info;

    key.vc = child_vc;

    circuit_id = GPOINTER_TO_UINT(wmem_map_lookup( circuit_chain_hashtable, &key ));

    if( circuit_id == 0 ) {

        new_key = wmem_new(wmem_file_scope(), circuit_chain_key);

        *new_key = key;

        circuit_id = ++circuit_chain_count;

        wmem_map_insert(circuit_chain_hashtable, new_key, GUINT_TO_POINTER(circuit_id));

    }

    return circuit_id;

}

static void

circuit_chain_init(void)

{

    circuit_chain_count = 1;

}

/***************************************************************************

 *

 * Call information management

 *

 */

/* we keep information on each call in an h223_call_info structure

 *

 * We attach the h223_call_info structures to individual calls with

 * circuit_add_proto_data().

*/

typedef struct _h223_mux_element_listitem h223_mux_element_listitem;

struct _h223_mux_element_listitem {

    h223_mux_element          *me;

    uint32_t                   first_frame;

    uint32_t                   pdu_offset;

    h223_mux_element_listitem *next;

};

/* we have this information for each stream */

typedef struct {

    h223_mux_element_listitem* mux_table[16];

} h223_call_direction_data;

struct _h223_call_info {

    /* H.223 level: 0 for standard H223, 1, 2 or 3 for the enhanced protocols

       specified in the annexes

    */

    int h223_level;

    /* for H.223 streams over TCP (as opposed to IAX), this

       stores the source address and port of the first packet spotted,

       so that we can differentiate directions.

    */

    address srcaddress;

    uint32_t srcport;

    h223_call_direction_data direction_data[2];

};

typedef struct _h223_lc_params_listitem h223_lc_params_listitem;

struct _h223_lc_params_listitem

{

    h223_lc_params         *lc_params;

    uint32_t                first_frame;

    uint32_t                last_frame;

    h223_lc_params_listitem *next;

};

typedef struct {

    h223_lc_params_listitem *lc_params[2];

    h223_call_info          *call_info;

} h223_vc_info;

static void

add_h223_mux_element(h223_call_direction_data *direct, uint8_t mc, h223_mux_element *me, uint32_t framenum)

{

    h223_mux_element_listitem *li;

    h223_mux_element_listitem **old_li_ptr;

    h223_mux_element_listitem *old_li;

    DISSECTOR_ASSERT(mc < 16);

    li = wmem_new(wmem_file_scope(), h223_mux_element_listitem);

    old_li_ptr = &(direct->mux_table[mc]);

    old_li = *old_li_ptr;

    if( !old_li ) {

        direct->mux_table[mc] = li;

    } else {

        while( old_li->next ) {

            old_li_ptr = &(old_li->next);

            old_li = *old_li_ptr;

        }

        if( framenum < old_li->first_frame || (framenum == old_li->first_frame && pdu_offset < old_li->pdu_offset)  )

            return;

        else if ( framenum == old_li->first_frame && pdu_offset == old_li->pdu_offset )

            *old_li_ptr = li; /* replace the tail of the list with the new item, since */

                              /* a single h223 pdu has just set the same MC twice.. */

        else

            old_li->next = li;

    }

    li->first_frame = framenum;

    li->pdu_offset = pdu_offset;

    li->next = 0;

    li->me = me;

}

static h223_mux_element*

find_h223_mux_element(h223_call_direction_data* direct, uint8_t mc, uint32_t framenum, uint32_t pkt_offset)

{

    h223_mux_element_listitem* li;

    DISSECTOR_ASSERT(mc < 16);

    li = direct->mux_table[mc];

    while( li && li->next && li->next->first_frame < framenum )

        li = li->next;

    while( li && li->next && li->next->first_frame == framenum && li->next->pdu_offset < pkt_offset )

        li = li->next;

    if( li ) {

        return li->me;

    } else {

        return NULL;

    }

}

static void

add_h223_lc_params(h223_vc_info* vc_info, int direction, h223_lc_params *lc_params, uint32_t framenum )

{

    h223_lc_params_listitem *li = wmem_new(wmem_file_scope(), h223_lc_params_listitem);

    h223_lc_params_listitem **old_li_ptr = &(vc_info->lc_params[direction ? 0 : 1]);

    h223_lc_params_listitem *old_li = *old_li_ptr;

    if( !old_li ) {

        vc_info->lc_params[direction ? 0 : 1] = li;

    } else {

        while( old_li->next ) {

            old_li_ptr = &(old_li->next);

            old_li = *old_li_ptr;

        }

        if( framenum < old_li->first_frame )

            return;

        else if( framenum == old_li->first_frame )

            *old_li_ptr = li;

        else {

            old_li->next = li;

            old_li->last_frame = framenum - 1;

        }

    }

    li->first_frame = framenum;

    li->last_frame = 0;

    li->next = 0;

    li->lc_params = lc_params;

}

static h223_lc_params*

find_h223_lc_params(h223_vc_info* vc_info, int direction, uint32_t framenum)

{

    h223_lc_params_listitem* li = vc_info->lc_params[direction? 0 : 1];

    while( li && li->next && li->next->first_frame <= framenum )

        li = li->next;

    if( li )

        return li->lc_params;

    else

        return NULL;

}

static void

init_direction_data(h223_call_direction_data *direct)

{

    int i;

    h223_mux_element *mc0_element;

    for ( i = 0; i < 16; ++i )

        direct->mux_table[i] = NULL;

    /* set up MC 0 to contain just VC 0 */

    mc0_element = wmem_new(wmem_file_scope(), h223_mux_element);

    add_h223_mux_element( direct, 0, mc0_element, 0 );

    mc0_element->sublist = NULL;

    mc0_element->vc = 0;

    mc0_element->repeat_count = 0; /* until closing flag */

    mc0_element->next = NULL;

}

static h223_vc_info*

h223_vc_info_new( h223_call_info* call_info )

{

    h223_vc_info *vc_info = wmem_new(wmem_file_scope(), h223_vc_info);

    vc_info->lc_params[0] = vc_info->lc_params[1] = NULL;

    vc_info->call_info = call_info;

    return vc_info;

}

static void

init_logical_channel( uint32_t start_frame, h223_call_info* call_info, int vc, int direction, h223_lc_params* params )

{

    uint32_t circuit_id = circuit_chain_lookup(call_info, vc);

    conversation_t *subcircuit;

    h223_vc_info *vc_info;

    subcircuit = find_conversation_by_id( start_frame, CONVERSATION_H223, circuit_id);

    if( subcircuit == NULL ) {

        subcircuit = conversation_new_by_id( start_frame, CONVERSATION_H223, circuit_id);

#ifdef DEBUG_H223

        ws_debug("%d: Created new circuit %d for call %p VC %d", start_frame, circuit_id, call_info, vc);

#endif

        vc_info = h223_vc_info_new( call_info );

        conversation_add_proto_data( subcircuit, proto_h223, vc_info );

    } else {

        vc_info = (h223_vc_info *)conversation_get_proto_data( subcircuit, proto_h223 );

    }

    if (vc_info)

        add_h223_lc_params( vc_info, direction, params, start_frame );

}

/* create a brand-new h223_call_info structure */

static h223_call_info *

create_call_info( uint32_t start_frame )

{

    h223_call_info *datax;

    h223_lc_params *vc0_params;

    datax = wmem_new(wmem_file_scope(), h223_call_info);

    /* initialise the call info */

    init_direction_data(&datax -> direction_data[0]);

    init_direction_data(&datax -> direction_data[1]);

    /* FIXME shouldn't this be figured out dynamically? */

    datax -> h223_level = 2;

    vc0_params = wmem_new(wmem_file_scope(), h223_lc_params);

    vc0_params->al_type = al1Framed;

    vc0_params->al_params = NULL;

    vc0_params->segmentable = true;

    vc0_params->subdissector = srp_handle;

    init_logical_channel( start_frame, datax, 0, P2P_DIR_SENT, vc0_params );

    init_logical_channel( start_frame, datax, 0, P2P_DIR_RECV, vc0_params );

    return datax;

}

/* find or create call_info struct for calls over circuits (eg, IAX) */

static h223_call_info *

find_or_create_call_info_circ(packet_info * pinfo, conversation_type ctype, uint32_t circuit_id)

{

    h223_call_info *datax;

    conversation_t *circ = NULL;

    if(ctype != CONVERSATION_NONE)

        circ = find_conversation_by_id( pinfo->num, ctype, circuit_id);

    if(circ == NULL)

        return NULL;

    datax = (h223_call_info *)conversation_get_proto_data(circ, proto_h223);

    if( datax == NULL ) {

        datax = create_call_info(pinfo->num);

#ifdef DEBUG_H223

        ws_debug("%u: Created new call %p for circuit %p ctype %d, id %u",

                pinfo->num, datax, circ, type, circuit_id);

#endif

        conversation_add_proto_data(circ, proto_h223, datax);

    }

    /* work out what direction we're really going in */

    if( pinfo->p2p_dir < 0 || pinfo->p2p_dir > 1)

        pinfo->p2p_dir = P2P_DIR_SENT;

    return datax;

}

/* find or create call_info struct for calls over conversations (eg, RTP) */

static h223_call_info *

find_or_create_call_info_conv(packet_info * pinfo)

{

    h223_call_info *datax;

    conversation_t *conv;

    /* assume we're running atop TCP or RTP; use the conversation support */

    conv = find_conversation_pinfo(pinfo, 0 );

    /* both RTP and TCP track their conversations, so just assert here if

     * we can't find one */

    DISSECTOR_ASSERT(conv);

    datax = (h223_call_info *)conversation_get_proto_data(conv, proto_h223);

    if(datax == NULL && pinfo->ptype == PT_UDP ) {

        conversation_t *conv2;

        /* RTP tracks the two sides of the conversation totally separately;

         * this messes us up totally.

         *

         * Look for another converstation, going in the opposite direction.

         */

        conv2 = find_conversation( pinfo->num,

                                  &pinfo->dst,&pinfo->src,

                                  conversation_pt_to_conversation_type(pinfo->ptype),

                                  pinfo->destport,pinfo->srcport, 0 );

        if(conv2 != NULL)

            datax = (h223_call_info *)conversation_get_proto_data(conv2, proto_h223);

        if(datax != NULL) {

#ifdef DEBUG_H223

            ws_debug("%u: Identified conv %p as reverse of conv %p with call %p and type=%u src=%u.%u.%u.%u:%u dst=%u.%u.%u.%u:%u",

                    pinfo->num, conv, conv2, datax, pinfo->ptype,

                    pinfo->dst.data[0], pinfo->dst.data[1], pinfo->dst.data[2], pinfo->dst.data[3],

                    pinfo->destport,

                    pinfo->src.data[0], pinfo->src.data[1], pinfo->src.data[2], pinfo->src.data[3],

                    pinfo->srcport);

#endif

            conversation_add_proto_data(conv, proto_h223, datax);

        }

    }

    /* we still haven't found any call data - create a new one for this

     * conversation */

    if(datax == NULL) {

        datax = create_call_info(pinfo->num);

#ifdef DEBUG_H223

        ws_debug("%u: Created new call %p for conv %p type=%u src=%u.%u.%u.%u:%u dst=%u.%u.%u.%u:%u",

                pinfo->num, datax, conv, pinfo->ptype,

                pinfo->src.data[0], pinfo->src.data[1], pinfo->src.data[2], pinfo->src.data[3],

                pinfo->srcport,

                pinfo->dst.data[0], pinfo->dst.data[1], pinfo->dst.data[2], pinfo->dst.data[3],

                pinfo->destport);

#endif

        conversation_add_proto_data(conv, proto_h223, datax);

        /* add the source details so we can distinguish directions

         * in future */

        copy_address_wmem(wmem_file_scope(), &(datax -> srcaddress), &(pinfo->src));

        datax -> srcport = pinfo->srcport;

    }

    /* work out what direction we're really going in */

    if( addresses_equal( &(pinfo->src), &(datax->srcaddress))

        && pinfo->srcport == datax->srcport )

        pinfo->p2p_dir = P2P_DIR_SENT;

    else

        pinfo->p2p_dir = P2P_DIR_RECV;

    return datax;

}

static h223_call_info *

find_or_create_call_info ( packet_info * pinfo, conversation_type ctype, uint32_t circuit_id )

{

    h223_call_info *datax;

    datax = find_or_create_call_info_circ(pinfo, ctype, circuit_id);

    if(datax == NULL)

        datax = find_or_create_call_info_conv(pinfo);

    return datax;

}

/* called from the h245 dissector to handle a MultiplexEntrySend message */

static void

h223_set_mc( packet_info* pinfo, uint8_t mc, h223_mux_element* me)

{

    conversation_t *circ = find_conversation_pinfo( pinfo, 0 );

    h223_vc_info* vc_info;

    /* if this h245 pdu packet came from an h223 circuit, add the details on

     * the new mux entry */

    if(circ) {

        vc_info = (h223_vc_info *)conversation_get_proto_data(circ, proto_h223);

        if (vc_info != NULL)

            add_h223_mux_element( &(vc_info->call_info->direction_data[pinfo->p2p_dir ? 0 : 1]), mc, me, pinfo->num );

    }

}

/* called from the h245 dissector to handle an OpenLogicalChannelAck message */

static void

h223_add_lc( packet_info* pinfo, uint16_t lc, h223_lc_params* params )

{

    conversation_t *circ = find_conversation_pinfo( pinfo, 0 );

    h223_vc_info* vc_info;

    /* if this h245 pdu packet came from an h223 circuit, add the details on

     * the new channel */

    if(circ) {

        vc_info = (h223_vc_info *)conversation_get_proto_data(circ, proto_h223);

        if (vc_info != NULL)

            init_logical_channel( pinfo->num, vc_info->call_info, lc, pinfo->p2p_dir, params );

    }

}

/************************************************************************************

 *

 * AL-PDU dissection

 */

static const uint8_t crctable[256] = {

    0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75, 0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,

    0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69, 0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,

    0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d, 0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,

    0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51, 0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,

    0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05, 0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,

    0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19, 0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,

    0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d, 0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,

    0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21, 0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,

    0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95, 0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,

    0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89, 0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,

    0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad, 0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,

    0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1, 0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,

    0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5, 0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,

    0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9, 0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,

    0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd, 0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,

    0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1, 0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf };

static uint8_t h223_al2_crc8bit( tvbuff_t *tvb ) {

    uint32_t len = tvb_reported_length(tvb) - 1;

    const uint8_t* datax = tvb_get_ptr( tvb, 0, len );

    unsigned char crc = 0;

    uint32_t pos = 0;

    DISSECTOR_ASSERT(tvb_reported_length(tvb) >= 1);

    while ( len-- )

        crc = crctable[crc^datax[pos++]];

    return crc;

}

static void

dissect_mux_al_pdu( tvbuff_t *tvb, packet_info *pinfo, proto_tree *vc_tree,

/*                  circuit_t* vc_circuit, */

                    h223_lc_params* lc_params )

{

    proto_tree *al_tree = NULL;

    proto_item *al_item, *hidden_item;

    proto_tree *al_subtree;

    proto_item *al_subitem = NULL;

    proto_item *tmp_item;

    tvbuff_t *next_tvb = NULL;

    dissector_handle_t subdissector = lc_params->subdissector;

    uint32_t len = tvb_reported_length(tvb);

    uint8_t calc_checksum;

    uint8_t real_checksum;

    bool al2_sequenced = false;

    int data_start;

    switch( lc_params->al_type ) {

        case al1Framed:

        case al1NotFramed:

            al_item = proto_tree_add_none_format(vc_tree, hf_h223_al1, tvb, 0, -1, "H.223 AL1 (%sframed)",

                                                 (lc_params->al_type==al1Framed)?"":"not ");

            al_tree = proto_item_add_subtree (al_item, ett_h223_al1);

            if(lc_params->al_type == al1Framed) {

                hidden_item = proto_tree_add_boolean(al_tree, hf_h223_al1_framed, tvb, 0, 1, true );

                proto_item_set_hidden(hidden_item);

            }

            next_tvb = tvb;

            al_subitem = proto_tree_add_item(al_tree, hf_h223_al_payload, next_tvb, 0, -1, ENC_NA);

            break;

        case al2WithSequenceNumbers:

            al2_sequenced = true;

            /* fall-through */

        case al2WithoutSequenceNumbers:

            tmp_item = proto_tree_add_boolean(vc_tree, hf_h223_al2, tvb, 0, 0, true );

            al_item = proto_tree_add_item(vc_tree,

                                          al2_sequenced?hf_h223_al2_sequenced:hf_h223_al2_unsequenced,

                                          tvb, 0, -1, ENC_NA);

            al_tree = proto_item_add_subtree (al_item, ett_h223_al2);

            proto_item_set_generated(tmp_item);

            /* check minimum payload length */

            if(len < (al2_sequenced?2U:1U))

                THROW(BoundsError);

            data_start = 0;

            if( al2_sequenced ) {

                proto_tree_add_item(al_tree, hf_h223_al2_seqno, tvb, 0, 1, ENC_LITTLE_ENDIAN);

                data_start++;

            }

            next_tvb = tvb_new_subset_length( tvb, data_start, len-1-data_start);

            al_subitem = proto_tree_add_item(al_tree, hf_h223_al_payload, next_tvb, 0, -1, ENC_NA);

            calc_checksum = h223_al2_crc8bit(tvb);

            real_checksum = tvb_get_uint8(tvb, len - 1);

            proto_tree_add_checksum(al_tree, tvb, len - 1, hf_h223_al2_crc, hf_h223_al2_crc_status, &ei_h223_al2_crc, pinfo, calc_checksum, ENC_NA, PROTO_CHECKSUM_VERIFY);

            if( calc_checksum != real_checksum ) {

                /* don't pass pdus which fail checksums on to the subdissector */

                subdissector = data_handle;

            }

            break;

        default:

            call_dissector(data_handle, tvb, pinfo, vc_tree);

            return;

    }

    if (!subdissector)

        subdissector = data_handle;

    al_subtree = proto_item_add_subtree(al_subitem, ett_h223_al_payload);

    call_dissector(subdissector, next_tvb, pinfo, al_subtree);

}

/************************************************************************************

 *

 * MUX-PDU dissection

 */

/* dissect a fragment of a MUX-PDU which belongs to a particular VC

 *

 * tvb          buffer containing the MUX-PDU fragment

 * pinfo        info on the packet containing the last fragment of the MUX-PDU

 * pkt_offset   offset within the block from the superdissector where the

 *                fragment starts (must increase monotonically for constant pinfo->num)

 * pdu_tree     dissection tree for the PDU; a single item will be added (with

 *              its own subtree)

 * vc           VC for this SDU

 * end_of_mux_sdu true if this is a segmentable VC and this is the last

 *              fragment in an SDU

 */

static void

dissect_mux_sdu_fragment(tvbuff_t *volatile next_tvb, packet_info *pinfo,

                         uint32_t pkt_offset, proto_tree *pdu_tree,

                         h223_call_info* call_info, uint16_t vc,

                         bool end_of_mux_sdu, conversation_type orig_ctype,

                         uint32_t orig_circuit)

{

    TRY {

        /* update the circuit details before passing to a subdissector */

        uint32_t circuit_id = circuit_chain_lookup(call_info, vc);

        conversation_set_elements_by_id(pinfo, CONVERSATION_H223, circuit_id);

        conversation_t *subcircuit = find_conversation_by_id(pinfo->num, CONVERSATION_H223, circuit_id);

        proto_tree *vc_tree;

        proto_item *vc_item;

        h223_vc_info *vc_info = NULL;

        h223_lc_params *lc_params = NULL;

        vc_item = proto_tree_add_uint(pdu_tree, hf_h223_mux_vc, next_tvb, 0, tvb_reported_length(next_tvb), vc);

        vc_tree = proto_item_add_subtree (vc_item, ett_h223_mux_vc);

        if( subcircuit == NULL ) {

            ws_message( "Frame %d: Subcircuit id %d not found for call %p VC %d", pinfo->num,

                       circuit_id, (void *)call_info, vc );

        } else {

            vc_info = (h223_vc_info *)conversation_get_proto_data(subcircuit, proto_h223);

            if( vc_info != NULL ) {

                lc_params = find_h223_lc_params( vc_info, pinfo->p2p_dir, pinfo->num );

            }

        }

        if( lc_params != NULL ) {

                if( lc_params->segmentable && lc_params->al_type != al1NotFramed ) {

                    stream_t *substream;

                    stream_pdu_fragment_t *frag;

                    substream = find_stream(subcircuit,pinfo->p2p_dir);

                    if(substream == NULL )

                        substream = stream_new(subcircuit,pinfo->p2p_dir);

                    frag = stream_find_frag(substream,pinfo->num,pkt_offset);

                    if(frag == NULL ) {

#ifdef DEBUG_H223

                        ws_debug("%d: New H.223 VC fragment: Parent circuit %d; subcircuit %d; offset %d; len %d, end %d",

                                pinfo->num, orig_circuit, circuit_id, pkt_offset, tvb_reported_length(next_tvb), end_of_mux_sdu);

#endif

                        frag = stream_add_frag(substream,pinfo->num,pkt_offset,

                                               next_tvb,pinfo,!end_of_mux_sdu);

                    } else {

#ifdef DEBUG_H223

                        ws_debug("%d: Found H.223 VC fragment: Parent circuit %d; subcircuit %d; offset %d; len %d, end %d",

                                pinfo->num, orig_circuit, circuit_id, pkt_offset, tvb_reported_length(next_tvb), end_of_mux_sdu);

#endif

                    }

                    next_tvb = stream_process_reassembled(

                        next_tvb, 0, pinfo,

                        "Reassembled H.223 AL-PDU",

                        frag, &h223_al_frag_items,

                        NULL, vc_tree);

                }

                if(next_tvb) {

                    /* fudge to pass pkt_offset down to add_h223_mux_element,

                     * should it be called */

                    pdu_offset = pkt_offset;

                    dissect_mux_al_pdu(next_tvb, pinfo, vc_tree,/* subcircuit,*/ lc_params );

                }

        } else {

            call_dissector(data_handle,next_tvb,pinfo,vc_tree);

        }

    }

    /* restore the original circuit details for future PDUs */

    FINALLY {

        conversation_set_elements_by_id(pinfo, orig_ctype, orig_circuit);

    }

    ENDTRY;

}

static uint32_t

// NOLINTNEXTLINE(misc-no-recursion)

mux_element_sublist_size(packet_info *pinfo, h223_mux_element* me)

{

    h223_mux_element *current_me = me->next;

    uint32_t length = 0;

    increment_dissection_depth(pinfo);

    while ( current_me ) {

        if ( current_me->sublist )

            length += current_me->repeat_count * mux_element_sublist_size(pinfo, current_me->sublist);

        else

            length += current_me->repeat_count;

        current_me = current_me->next;

    }

    decrement_dissection_depth(pinfo);

    /* should never happen, but to avoid infinite loops... */

    DISSECTOR_ASSERT(length != 0);

    return length;

}

/* dissect part of a MUX-PDU payload according to a multiplex list

 *

 * tvb          buffer containing entire mux-pdu payload

 * pinfo        info on the packet containing the last fragment of the MUX-PDU

 * pkt_offset   offset within the block from the superdissector where the

 *                MUX-PDU starts (must increase monotonically for constant

 *                pinfo->num)

 * pdu_tree     dissection tree for the PDU

 * call_info    data structure for h223 call

 * me           top of mux list

 * offset       offset within tvb to start work

 * endOfMuxSdu  true if the end-of-sdu flag was set

 */

static uint32_t

// NOLINTNEXTLINE(misc-no-recursion)

dissect_mux_payload_by_me_list( tvbuff_t *tvb, packet_info *pinfo,

                                uint32_t pkt_offset, proto_tree *pdu_tree,

                                h223_call_info* call_info,

                                h223_mux_element *me, uint32_t offset,

                                bool endOfMuxSdu, conversation_type ctype,

                                uint32_t circuit_id)

{

    uint32_t len = tvb_reported_length(tvb);

    uint32_t frag_len;

    uint32_t sublist_len;

    int i;

    increment_dissection_depth(pinfo);

    while ( me ) {

        if ( me->sublist ) {

            if ( me->repeat_count == 0 ) {

                for(sublist_len = mux_element_sublist_size(pinfo, me->sublist);

                    offset + sublist_len <= len;

                    offset = dissect_mux_payload_by_me_list( tvb, pinfo, pkt_offset, pdu_tree,

                                                             call_info, me->sublist, offset, endOfMuxSdu,

                                                             ctype, circuit_id) );

            } else {

                for(i = 0; i < me->repeat_count; ++i)

                    offset = dissect_mux_payload_by_me_list( tvb, pinfo, pkt_offset, pdu_tree,

                                                             call_info, me->sublist, offset, endOfMuxSdu,

                                                             ctype, circuit_id);

            }

        } else {

            if ( me->repeat_count == 0 )

                frag_len = len - offset;

            else

                frag_len = me->repeat_count;

            if(frag_len > 0) {

                tvbuff_t *next_tvb;

                next_tvb = tvb_new_subset_length(tvb, offset, frag_len);

                dissect_mux_sdu_fragment( next_tvb, pinfo, pkt_offset + offset, pdu_tree,

                                          call_info, me->vc, (offset+frag_len==len) && endOfMuxSdu,

                                          ctype, circuit_id);

                offset += frag_len;

            }

        }

        me = me->next;

    }

    decrement_dissection_depth(pinfo);

    return offset;

}

/* dissect the payload of a MUX-PDU

 *

 * tvb          buffer containing entire mux-pdu payload

 * pinfo        info on the packet containing the last fragment of the MUX-PDU

 * pkt_offset   offset within the block from the superdissector where the

 *                MUX-PDU starts (must increase monotonically for constant

 *                pinfo->num)

 * pdu_tree     dissection tree for the PDU

 * call_info    data structure for h223 call

 * mc           multiplex code for this PDU

 * endOfMuxSdu  true if the end-of-sdu flag was set

 */

static void

dissect_mux_payload( tvbuff_t *tvb, packet_info *pinfo, uint32_t pkt_offset,

                     proto_tree *pdu_tree, h223_call_info *call_info,

                     uint8_t mc, bool endOfMuxSdu, conversation_type ctype,

                     uint32_t circuit_id )

{

    uint32_t len = tvb_reported_length(tvb);

    h223_mux_element* me = find_h223_mux_element( &(call_info->direction_data[pinfo->p2p_dir ? 0 : 1]), mc, pinfo->num, pkt_offset );

    if( me ) {

        dissect_mux_payload_by_me_list( tvb, pinfo, pkt_offset, pdu_tree, call_info, me, 0, endOfMuxSdu, ctype, circuit_id );

    } else {

        /* no entry found in mux-table. ignore packet and dissect as data */

        proto_tree *vc_tree = NULL;

        if(pdu_tree) {

            proto_item *vc_item = proto_tree_add_item(pdu_tree, hf_h223_mux_deact, tvb, 0, len, ENC_NA);

            vc_tree = proto_item_add_subtree(vc_item, ett_h223_mux_deact);

        }

        call_dissector(data_handle,tvb,pinfo,vc_tree);

    }

}

/* dissect a reassembled mux-pdu

 *

 * tvb          buffer containing mux-pdu, including header and closing flag

 * pinfo        packet info for packet containing the end of the mux-pdu

 * pkt_offset   offset within the block from the superdissector where the

 *                MUX-PDU starts (must increase monotonically for constant

 *                pinfo->num)

 * h223_tree    dissection tree for h223 protocol; a single item will be added

 *              (with a sub-tree)

 * call_info    h223 info structure for this h223 call

 * pdu_no       index of this pdu within the call

 */

static void

dissect_mux_pdu( tvbuff_t *tvb, packet_info *pinfo, uint32_t pkt_offset,

                 proto_tree *h223_tree, h223_call_info *call_info,

                 conversation_type ctype, uint32_t circuit_id)

{

    uint32_t offset = 0;

    /* actual (as opposed to reported) payload len */

    uint32_t len;

    uint32_t raw_hdr = 0, correct_hdr = 0;

    int32_t errors = 0;

    uint16_t closing_flag = 0;

    uint8_t mc = 0;

    uint8_t mpl = 0;

    bool end_of_mux_sdu = false;