LLVMFuzzerTestOneInput: 4| 1.33k|{ 5| 1.33k| AcseConnection acseConnection; 6| 1.33k| AcseConnection_init(&acseConnection, NULL, NULL, NULL); 7| | 8| 1.33k| ByteBuffer* acseBuffer = ByteBuffer_create(NULL, size); 9| 1.33k| ByteBuffer_append(acseBuffer, data, size); 10| 1.33k| AcseConnection_parseMessage(&acseConnection, acseBuffer); 11| | 12| 1.33k| ByteBuffer_destroy(acseBuffer); 13| 1.33k| return 0; 14| 1.33k|} Memory_calloc: 43| 2.66k|{ 44| 2.66k| void* memory = calloc(nmemb, size); 45| | 46| 2.66k| if (memory == NULL) ------------------ | Branch (46:9): [True: 0, False: 2.66k] ------------------ 47| 0| noMemoryAvailableHandler(); 48| | 49| 2.66k| return memory; 50| 2.66k|} Memory_free: 65| 2.66k|{ 66| 2.66k| free(memb); 67| 2.66k|} ByteBuffer_create: 29| 1.33k|{ 30| 1.33k| if (self == NULL) ------------------ | Branch (30:9): [True: 1.33k, False: 0] ------------------ 31| 1.33k| { 32| 1.33k| self = (ByteBuffer*)GLOBAL_CALLOC(1, sizeof(ByteBuffer)); ------------------ | | 20| 1.33k|#define GLOBAL_CALLOC(nmemb, size) Memory_calloc(nmemb, size) ------------------ 33| 1.33k| } 34| | 35| 1.33k| if (self) ------------------ | Branch (35:9): [True: 1.33k, False: 0] ------------------ 36| 1.33k| { 37| 1.33k| self->buffer = (uint8_t*)GLOBAL_CALLOC(maxSize, sizeof(uint8_t)); ------------------ | | 20| 1.33k|#define GLOBAL_CALLOC(nmemb, size) Memory_calloc(nmemb, size) ------------------ 38| | 39| 1.33k| if (self->buffer == NULL) ------------------ | Branch (39:13): [True: 0, False: 1.33k] ------------------ 40| 0| { 41| 0| GLOBAL_FREEMEM(self); ------------------ | | 23| 0|#define GLOBAL_FREEMEM(ptr) Memory_free(ptr) ------------------ 42| 0| self = NULL; 43| 0| } 44| 1.33k| else 45| 1.33k| { 46| 1.33k| self->maxSize = maxSize; 47| 1.33k| self->size = 0; 48| 1.33k| } 49| 1.33k| } 50| | 51| 1.33k| return self; 52| 1.33k|} ByteBuffer_destroy: 56| 1.33k|{ 57| 1.33k| GLOBAL_FREEMEM(self->buffer); ------------------ | | 23| 1.33k|#define GLOBAL_FREEMEM(ptr) Memory_free(ptr) ------------------ 58| 1.33k| GLOBAL_FREEMEM(self); ------------------ | | 23| 1.33k|#define GLOBAL_FREEMEM(ptr) Memory_free(ptr) ------------------ 59| 1.33k|} ByteBuffer_append: 71| 1.33k|{ 72| 1.33k| if (self->size + dataSize <= self->maxSize) ------------------ | Branch (72:9): [True: 1.33k, False: 0] ------------------ 73| 1.33k| { 74| 1.33k| memcpy(self->buffer + self->size, data, dataSize); 75| 1.33k| self->size += dataSize; 76| 1.33k| return dataSize; 77| 1.33k| } 78| 0| else 79| 0| { 80| 0| return -1; 81| 0| } 82| 1.33k|} BerDecoder_decodeLength: 128| 1.09M|{ 129| 1.09M| return BerDecoder_decodeLengthRecursive(buffer, length, bufPos, maxBufPos, 0, 50); 130| 1.09M|} BerDecoder_decodeUint32: 151| 145k|{ 152| 145k| uint32_t value = 0; 153| | 154| 145k| int i; 155| 320k| for (i = 0; i < intLen; i++) ------------------ | Branch (155:17): [True: 176k, False: 143k] ------------------ 156| 176k| { 157| 176k| value <<= 8; 158| 176k| value += buffer[bufPos + i]; 159| | 160| 176k| if (i == 3) ------------------ | Branch (160:13): [True: 1.55k, False: 174k] ------------------ 161| 1.55k| break; /* only accept up to 4 bytes for uint32 */ 162| 176k| } 163| | 164| 145k| return value; 165| 145k|} BerDecoder_decodeInt32: 169| 24.5k|{ 170| 24.5k| if ((intlen <= 0) || (intlen > 4)) ------------------ | Branch (170:9): [True: 17.3k, False: 7.24k] | Branch (170:26): [True: 209, False: 7.03k] ------------------ 171| 17.5k| return 0; 172| | 173| 7.03k| uint32_t value; 174| 7.03k| int i; 175| | 176| 7.03k| bool isNegative = ((buffer[bufPos] & 0x80) == 0x80); 177| | 178| 7.03k| if (isNegative) ------------------ | Branch (178:9): [True: 4.18k, False: 2.85k] ------------------ 179| 4.18k| value = -0xffffffff; /* initialize to all 1s for -1 */ 180| 2.85k| else 181| 2.85k| value = 0; 182| | 183| 14.2k| for (i = 0; i < intlen; i++) ------------------ | Branch (183:17): [True: 7.24k, False: 7.03k] ------------------ 184| 7.24k| { 185| 7.24k| value <<= 8; 186| 7.24k| value += buffer[bufPos + i]; 187| 7.24k| } 188| | 189| 7.03k| return (int32_t)value; 190| 24.5k|} BerDecoder_decodeOID: 256| 19.4k|{ 257| 19.4k| int startPos = bufPos; 258| 19.4k| int currentArc = 0; 259| | 260| | /* clear all arcs */ 261| 19.4k| int i; 262| 213k| for (i = 0; i < 10; i++) ------------------ | Branch (262:17): [True: 194k, False: 19.4k] ------------------ 263| 194k| oid->arc[i] = 0; 264| | 265| | /* parse first two arcs */ 266| 19.4k| if (length > 0) ------------------ | Branch (266:9): [True: 6.28k, False: 13.1k] ------------------ 267| 6.28k| { 268| 6.28k| oid->arc[0] = buffer[bufPos] / 40; 269| 6.28k| oid->arc[1] = buffer[bufPos] % 40; 270| | 271| 6.28k| currentArc = 2; 272| 6.28k| bufPos++; 273| 6.28k| } 274| | 275| | /* parse remaining arcs */ 276| 25.3k| while ((bufPos - startPos < length) && (currentArc < 10)) ------------------ | Branch (276:12): [True: 5.96k, False: 19.3k] | Branch (276:44): [True: 5.89k, False: 63] ------------------ 277| 5.89k| { 278| 5.89k| oid->arc[currentArc] = oid->arc[currentArc] << 7; 279| | 280| 5.89k| if (buffer[bufPos] < 0x80) ------------------ | Branch (280:13): [True: 4.65k, False: 1.24k] ------------------ 281| 4.65k| oid->arc[currentArc++] += buffer[bufPos]; 282| 1.24k| else 283| 1.24k| oid->arc[currentArc] += (buffer[bufPos] & 0x7f); 284| | 285| 5.89k| bufPos++; 286| 5.89k| } 287| | 288| 19.4k| oid->arcCount = currentArc; 289| 19.4k|} ber_decode.c:BerDecoder_decodeLengthRecursive: 75| 10.7M|{ 76| 10.7M| if (bufPos >= maxBufPos) ------------------ | Branch (76:9): [True: 271, False: 10.7M] ------------------ 77| 271| return -1; 78| | 79| 10.7M| uint8_t len1 = buffer[bufPos++]; 80| | 81| 10.7M| if (len1 & 0x80) ------------------ | Branch (81:9): [True: 372k, False: 10.3M] ------------------ 82| 372k| { 83| 372k| int lenLength = len1 & 0x7f; 84| | 85| 372k| if (lenLength == 0) ------------------ | Branch (85:13): [True: 61.6k, False: 310k] ------------------ 86| 61.6k| { /* indefinite length form */ 87| 61.6k| *length = getIndefiniteLength(buffer, bufPos, maxBufPos, depth, maxDepth); 88| 61.6k| } 89| 310k| else if (lenLength < 4) ------------------ | Branch (89:18): [True: 310k, False: 34] ------------------ 90| 310k| { 91| 310k| *length = 0; 92| | 93| 310k| int i; 94| 622k| for (i = 0; i < lenLength; i++) ------------------ | Branch (94:25): [True: 311k, False: 310k] ------------------ 95| 311k| { 96| 311k| if (bufPos >= maxBufPos) ------------------ | Branch (96:21): [True: 11, False: 311k] ------------------ 97| 11| return -1; 98| | 99| 311k| if (bufPos + (*length) > maxBufPos) ------------------ | Branch (99:21): [True: 1, False: 311k] ------------------ 100| 1| return -1; 101| | 102| 311k| *length <<= 8; 103| 311k| *length += buffer[bufPos++]; 104| 311k| } 105| 310k| } 106| 34| else 107| 34| { 108| | /* only accept a maximum of 3 length bytes*/ 109| 34| return -1; 110| 34| } 111| 372k| } 112| 10.3M| else 113| 10.3M| { 114| 10.3M| *length = len1; 115| 10.3M| } 116| | 117| 10.7M| if (*length < 0) ------------------ | Branch (117:9): [True: 1.38k, False: 10.7M] ------------------ 118| 1.38k| return -1; 119| | 120| 10.7M| if (bufPos + (*length) > maxBufPos) ------------------ | Branch (120:9): [True: 94, False: 10.7M] ------------------ 121| 94| return -1; 122| | 123| 10.7M| return bufPos; 124| 10.7M|} ber_decode.c:getIndefiniteLength: 32| 61.6k|{ 33| 61.6k| depth++; 34| | 35| 61.6k| if (depth > maxDepth) ------------------ | Branch (35:9): [True: 1, False: 61.6k] ------------------ 36| 1| return -1; 37| | 38| 61.6k| int length = 0; 39| | 40| 9.71M| while (bufPos < maxBufPos) ------------------ | Branch (40:12): [True: 9.71M, False: 42] ------------------ 41| 9.71M| { 42| 9.71M| if ((buffer[bufPos] == 0) && ((bufPos + 1) < maxBufPos) && (buffer[bufPos + 1] == 0)) ------------------ | Branch (42:13): [True: 557k, False: 9.15M] | Branch (42:38): [True: 557k, False: 17] | Branch (42:68): [True: 60.2k, False: 497k] ------------------ 43| 60.2k| { 44| 60.2k| return length + 2; 45| 60.2k| } 46| 9.65M| else 47| 9.65M| { 48| 9.65M| length++; 49| | 50| 9.65M| if ((buffer[bufPos++] & 0x1f) == 0x1f) ------------------ | Branch (50:17): [True: 452k, False: 9.20M] ------------------ 51| 452k| { 52| | /* handle extended tags */ 53| 452k| bufPos++; 54| 452k| length++; 55| 452k| } 56| | 57| 9.65M| int subLength = -1; 58| | 59| 9.65M| int newBufPos = BerDecoder_decodeLengthRecursive(buffer, &subLength, bufPos, maxBufPos, depth, maxDepth); 60| | 61| 9.65M| if (newBufPos == -1) ------------------ | Branch (61:17): [True: 1.33k, False: 9.65M] ------------------ 62| 1.33k| return -1; 63| | 64| 9.65M| length += subLength + newBufPos - bufPos; 65| | 66| 9.65M| bufPos = newBufPos + subLength; 67| 9.65M| } 68| 9.71M| } 69| | 70| 42| return -1; 71| 61.6k|} AcseConnection_init: 450| 1.33k|{ 451| 1.33k| self->state = idle; 452| 1.33k| self->nextReference = 0; 453| 1.33k| self->userDataBuffer = NULL; 454| 1.33k| self->userDataBufferSize = 0; 455| 1.33k| self->authenticator = authenticator; 456| 1.33k| self->authenticatorParameter = parameter; 457| | 458| |#if (CONFIG_MMS_SUPPORT_TLS == 1) 459| | self->tlsSocket = tlsSocket; 460| |#else 461| 1.33k| (void)tlsSocket; 462| 1.33k|#endif 463| | 464| 1.33k| memset(&(self->applicationReference), 0, 465| 1.33k| sizeof(self->applicationReference)); 466| 1.33k|} AcseConnection_parseMessage: 470| 1.33k|{ 471| 1.33k| AcseIndication indication = ACSE_ERROR; 472| | 473| 1.33k| if (message == NULL || message->size < 1) ------------------ | Branch (473:9): [True: 0, False: 1.33k] | Branch (473:28): [True: 0, False: 1.33k] ------------------ 474| 0| { 475| 0| if (DEBUG_ACSE) ------------------ | | 32| 0|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 0] | | ------------------ ------------------ 476| 0| printf("ACSE: invalid message - no payload\n"); 477| | 478| 0| return ACSE_ERROR; 479| 0| } 480| | 481| 1.33k| uint8_t* buffer = message->buffer; 482| | 483| 1.33k| int messageSize = message->size; 484| | 485| 1.33k| int bufPos = 0; 486| | 487| 1.33k| uint8_t messageType = buffer[bufPos++]; 488| | 489| 1.33k| int len; 490| | 491| 1.33k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, messageSize); 492| | 493| 1.33k| if (bufPos < 0) ------------------ | Branch (493:9): [True: 228, False: 1.10k] ------------------ 494| 228| { 495| 228| if (DEBUG_ACSE) ------------------ | | 32| 228|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 228] | | ------------------ ------------------ 496| 0| printf("ACSE: AcseConnection_parseMessage: invalid ACSE message!\n"); 497| | 498| 228| return ACSE_ERROR; 499| 228| } 500| | 501| 1.10k| switch (messageType) 502| 1.10k| { 503| 681| case 0x60: ------------------ | Branch (503:5): [True: 681, False: 425] ------------------ 504| 681| indication = parseAarqPdu(self, buffer, bufPos, bufPos + len); 505| 681| break; 506| 417| case 0x61: ------------------ | Branch (506:5): [True: 417, False: 689] ------------------ 507| 417| indication = parseAarePdu(self, buffer, bufPos, bufPos + len); 508| 417| break; 509| 1| case 0x62: /* A_RELEASE.request RLRQ-apdu */ ------------------ | Branch (509:5): [True: 1, False: 1.10k] ------------------ 510| 1| indication = ACSE_RELEASE_REQUEST; 511| 1| break; 512| 2| case 0x63: /* A_RELEASE.response RLRE-apdu */ ------------------ | Branch (512:5): [True: 2, False: 1.10k] ------------------ 513| 2| indication = ACSE_RELEASE_RESPONSE; 514| 2| break; 515| 1| case 0x64: /* A_ABORT */ ------------------ | Branch (515:5): [True: 1, False: 1.10k] ------------------ 516| 1| indication = ACSE_ABORT; 517| 1| break; 518| 1| case 0x00: /* indefinite length end tag -> ignore */ ------------------ | Branch (518:5): [True: 1, False: 1.10k] ------------------ 519| 1| break; 520| 3| default: ------------------ | Branch (520:5): [True: 3, False: 1.10k] ------------------ 521| 3| if (DEBUG_ACSE) ------------------ | | 32| 3|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 3] | | ------------------ ------------------ 522| 0| printf("ACSE: Unknown ACSE message\n"); 523| 3| indication = ACSE_ERROR; 524| 3| break; 525| 1.10k| } 526| | 527| 1.10k| return indication; 528| 1.10k|} acse.c:parseAarqPdu: 283| 681|{ 284| 681| if (DEBUG_ACSE) ------------------ | | 32| 681|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 681] | | ------------------ ------------------ 285| 0| printf("ACSE: parse AARQ PDU\n"); 286| | 287| 681| uint8_t* authValue = NULL; 288| 681| int authValueLen = 0; 289| 681| uint8_t* authMechanism = NULL; 290| 681| int authMechLen = 0; 291| 681| bool userInfoValid = false; 292| | 293| 607k| while (bufPos < maxBufPos) ------------------ | Branch (293:12): [True: 606k, False: 568] ------------------ 294| 606k| { 295| 606k| uint8_t tag = buffer[bufPos++]; 296| 606k| int len; 297| | 298| 606k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 299| | 300| 606k| if (bufPos < 0) ------------------ | Branch (300:13): [True: 72, False: 606k] ------------------ 301| 72| { 302| 72| if (DEBUG_ACSE) ------------------ | | 32| 72|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 72] | | ------------------ ------------------ 303| 0| printf("ACSE: Invalid PDU!\n"); 304| 72| return ACSE_ASSOCIATE_FAILED; 305| 72| } 306| | 307| 606k| if (len == 0) ------------------ | Branch (307:13): [True: 18.5k, False: 588k] ------------------ 308| 18.5k| continue; 309| | 310| 588k| if (bufPos + len > maxBufPos) ------------------ | Branch (310:13): [True: 0, False: 588k] ------------------ 311| 0| { 312| 0| if (DEBUG_ACSE) ------------------ | | 32| 0|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 0] | | ------------------ ------------------ 313| 0| printf("ACSE: Invalid PDU!\n"); 314| 0| return ACSE_ASSOCIATE_FAILED; 315| 0| } 316| | 317| 588k| switch (tag) 318| 588k| { 319| 0| case 0xa1: /* application context name */ ------------------ | Branch (319:9): [True: 0, False: 588k] ------------------ 320| 0| bufPos += len; 321| 0| break; 322| | 323| 235| case 0xa2: /* called AP title */ ------------------ | Branch (323:9): [True: 235, False: 587k] ------------------ 324| 235| bufPos += len; 325| 235| break; 326| 0| case 0xa3: /* called AE qualifier */ ------------------ | Branch (326:9): [True: 0, False: 588k] ------------------ 327| 0| bufPos += len; 328| 0| break; 329| | 330| 27.0k| case 0xa6: /* calling AP title */ ------------------ | Branch (330:9): [True: 27.0k, False: 560k] ------------------ 331| 27.0k| { 332| 27.0k| if (len >= 2 && buffer[bufPos] == 0x06) ------------------ | Branch (332:21): [True: 21.3k, False: 5.70k] | Branch (332:33): [True: 19.9k, False: 1.37k] ------------------ 333| 19.9k| { 334| | /* ap-title-form2 */ 335| | 336| 19.9k| int innerLength = buffer[bufPos + 1]; 337| | 338| 19.9k| if ((innerLength >= 0) && (innerLength == len - 2)) ------------------ | Branch (338:25): [True: 19.9k, False: 0] | Branch (338:47): [True: 19.4k, False: 536] ------------------ 339| 19.4k| BerDecoder_decodeOID(buffer, bufPos + 2, innerLength, &(self->applicationReference.apTitle)); 340| 19.9k| } 341| 27.0k| } 342| 27.0k| bufPos += len; 343| 27.0k| break; 344| | 345| 34.6k| case 0xa7: /* calling AE qualifier */ ------------------ | Branch (345:9): [True: 34.6k, False: 553k] ------------------ 346| 34.6k| { 347| 34.6k| if (len >= 2 && buffer[bufPos] == 0x02) ------------------ | Branch (347:21): [True: 34.2k, False: 487] | Branch (347:33): [True: 29.3k, False: 4.86k] ------------------ 348| 29.3k| { 349| | /* ae-qualifier-form2 */ 350| | 351| 29.3k| int innerLength = buffer[bufPos + 1]; 352| | 353| 29.3k| if ((innerLength >= 0) && (innerLength == len - 2)) ------------------ | Branch (353:25): [True: 29.3k, False: 0] | Branch (353:47): [True: 24.5k, False: 4.78k] ------------------ 354| 24.5k| self->applicationReference.aeQualifier = BerDecoder_decodeInt32(buffer, innerLength, bufPos + 2); 355| 29.3k| } 356| 34.6k| } 357| 34.6k| bufPos += len; 358| 34.6k| break; 359| | 360| 0| case 0x8a: /* sender ACSE requirements */ ------------------ | Branch (360:9): [True: 0, False: 588k] ------------------ 361| 0| bufPos += len; 362| 0| break; 363| | 364| 436| case 0x8b: /* (authentication) mechanism name */ ------------------ | Branch (364:9): [True: 436, False: 587k] ------------------ 365| 436| authMechLen = len; 366| 436| authMechanism = buffer + bufPos; 367| 436| bufPos += len; 368| 436| break; 369| | 370| 606| case 0xac: /* authentication value */ ------------------ | Branch (370:9): [True: 606, False: 587k] ------------------ 371| 606| bufPos++; 372| | 373| 606| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 374| 606| if (bufPos < 0) ------------------ | Branch (374:17): [True: 3, False: 603] ------------------ 375| 3| { 376| 3| if (DEBUG_ACSE) ------------------ | | 32| 3|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 3] | | ------------------ ------------------ 377| 0| printf("ACSE: Invalid PDU!\n"); 378| 3| return ACSE_ASSOCIATE_FAILED; 379| 3| } 380| | 381| 603| authValueLen = len; 382| 603| authValue = buffer + bufPos; 383| 603| bufPos += len; 384| 603| break; 385| | 386| 2.88k| case 0xbe: /* user information */ ------------------ | Branch (386:9): [True: 2.88k, False: 585k] ------------------ 387| 2.88k| if (buffer[bufPos] != 0x28) ------------------ | Branch (387:17): [True: 902, False: 1.98k] ------------------ 388| 902| { 389| 902| if (DEBUG_ACSE) ------------------ | | 32| 902|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 902] | | ------------------ ------------------ 390| 0| printf("ACSE: invalid user info\n"); 391| 902| bufPos += len; 392| 902| } 393| 1.98k| else 394| 1.98k| { 395| 1.98k| bufPos++; 396| | 397| 1.98k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 398| | 399| 1.98k| if (bufPos < 0) ------------------ | Branch (399:21): [True: 4, False: 1.97k] ------------------ 400| 4| { 401| 4| if (DEBUG_ACSE) ------------------ | | 32| 4|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 4] | | ------------------ ------------------ 402| 0| printf("ACSE: Invalid PDU!\n"); 403| 4| return ACSE_ASSOCIATE_FAILED; 404| 4| } 405| | 406| 1.97k| bufPos = parseUserInformation(self, buffer, bufPos, bufPos + len, &userInfoValid); 407| | 408| 1.97k| if (bufPos < 0) ------------------ | Branch (408:21): [True: 34, False: 1.94k] ------------------ 409| 34| { 410| 34| if (DEBUG_ACSE) ------------------ | | 32| 34|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 34] | | ------------------ ------------------ 411| 0| printf("ACSE: Invalid PDU!\n"); 412| 34| return ACSE_ASSOCIATE_FAILED; 413| 34| } 414| 1.97k| } 415| 2.84k| break; 416| | 417| 5.47k| case 0x00: /* indefinite length end tag -> ignore */ ------------------ | Branch (417:9): [True: 5.47k, False: 582k] ------------------ 418| 5.47k| break; 419| | 420| 516k| default: /* ignore unknown tag */ ------------------ | Branch (420:9): [True: 516k, False: 71.3k] ------------------ 421| 516k| if (DEBUG_ACSE) ------------------ | | 32| 516k|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 516k] | | ------------------ ------------------ 422| 0| printf("ACSE: parseAarqPdu: unknown tag %02x\n", tag); 423| | 424| 516k| bufPos += len; 425| 516k| break; 426| 588k| } 427| 588k| } 428| | 429| 568| if (checkAuthentication(self, authMechanism, authMechLen, authValue, authValueLen) == false) ------------------ | Branch (429:9): [True: 0, False: 568] ------------------ 430| 0| { 431| 0| if (DEBUG_ACSE) ------------------ | | 32| 0|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 0] | | ------------------ ------------------ 432| 0| printf("ACSE: parseAarqPdu: check authentication failed!\n"); 433| | 434| 0| return ACSE_ASSOCIATE_FAILED; 435| 0| } 436| | 437| 568| if (userInfoValid == false) ------------------ | Branch (437:9): [True: 557, False: 11] ------------------ 438| 557| { 439| 557| if (DEBUG_ACSE) ------------------ | | 32| 557|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 557] | | ------------------ ------------------ 440| 0| printf("ACSE: parseAarqPdu: user info invalid!\n"); 441| | 442| 557| return ACSE_ASSOCIATE_FAILED; 443| 557| } 444| | 445| 11| return ACSE_ASSOCIATE; 446| 568|} acse.c:parseUserInformation: 119| 4.29k|{ 120| 4.29k| if (DEBUG_ACSE) ------------------ | | 32| 4.29k|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 4.29k] | | ------------------ ------------------ 121| 0| printf("ACSE: parseUserInformation %i %i\n", bufPos, maxBufPos); 122| | 123| 4.29k| bool hasindirectReference = false; 124| 4.29k| bool isDataValid = false; 125| | 126| 210k| while (bufPos < maxBufPos) ------------------ | Branch (126:12): [True: 205k, False: 4.21k] ------------------ 127| 205k| { 128| 205k| uint8_t tag = buffer[bufPos++]; 129| 205k| int len; 130| | 131| 205k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 132| | 133| 205k| if ((bufPos < 0) || (bufPos + len > maxBufPos)) ------------------ | Branch (133:13): [True: 78, False: 205k] | Branch (133:29): [True: 0, False: 205k] ------------------ 134| 78| { 135| 78| *userInfoValid = false; 136| 78| return -1; 137| 78| } 138| | 139| 205k| if (len == 0) ------------------ | Branch (139:13): [True: 16.3k, False: 189k] ------------------ 140| 16.3k| continue; 141| | 142| 189k| switch (tag) 143| 189k| { 144| | 145| 144k| case 0x02: /* indirect-reference */ ------------------ | Branch (145:9): [True: 144k, False: 44.9k] ------------------ 146| 144k| self->nextReference = BerDecoder_decodeUint32(buffer, len, bufPos); 147| 144k| bufPos += len; 148| 144k| hasindirectReference = true; 149| 144k| break; 150| | 151| 1.71k| case 0xa0: /* encoding */ ------------------ | Branch (151:9): [True: 1.71k, False: 187k] ------------------ 152| 1.71k| isDataValid = true; 153| | 154| 1.71k| self->userDataBufferSize = len; 155| 1.71k| self->userDataBuffer = buffer + bufPos; 156| | 157| 1.71k| bufPos += len; 158| | 159| 1.71k| break; 160| | 161| 43.2k| default: /* ignore unknown tag */ ------------------ | Branch (161:9): [True: 43.2k, False: 146k] ------------------ 162| 43.2k| bufPos += len; 163| 189k| } 164| 189k| } 165| | 166| 4.21k| if (DEBUG_ACSE) ------------------ | | 32| 4.21k|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 4.21k] | | ------------------ ------------------ 167| 0| { 168| 0| if (!hasindirectReference) ------------------ | Branch (168:13): [True: 0, False: 0] ------------------ 169| 0| printf("ACSE: User data has no indirect reference!\n"); 170| | 171| 0| if (!isDataValid) ------------------ | Branch (171:13): [True: 0, False: 0] ------------------ 172| 0| printf("ACSE: No valid user data\n"); 173| 0| } 174| | 175| 4.21k| if (hasindirectReference && isDataValid) ------------------ | Branch (175:9): [True: 1.88k, False: 2.33k] | Branch (175:33): [True: 535, False: 1.35k] ------------------ 176| 535| *userInfoValid = true; 177| 3.68k| else 178| 3.68k| *userInfoValid = false; 179| | 180| 4.21k| return bufPos; 181| 4.29k|} acse.c:checkAuthentication: 84| 568|{ 85| 568| self->securityToken = NULL; 86| | 87| 568| if (self->authenticator != NULL) ------------------ | Branch (87:9): [True: 0, False: 568] ------------------ 88| 0| { 89| 0| AcseAuthenticationMechanism mechanism = checkAuthMechanismName(authMechanism, authMechLen); 90| | 91| 0| if (mechanism == ACSE_AUTH_NONE) ------------------ | Branch (91:13): [True: 0, False: 0] ------------------ 92| 0| { 93| |#if (CONFIG_MMS_SUPPORT_TLS == 1) 94| | if (self->tlsSocket) 95| | { 96| | int certLen; 97| | 98| | uint8_t* certBuf = TLSSocket_getPeerCertificate(self->tlsSocket, &certLen); 99| | 100| | if (certBuf) { 101| | mechanism = ACSE_AUTH_TLS; 102| | authValue = certBuf; 103| | authValueLen = certLen; 104| | } 105| | 106| | } 107| |#endif /* (CONFIG_MMS_SUPPORT_TLS == 1) */ 108| | 109| 0| } 110| | 111| 0| return authenticateClient(self, mechanism, authValue, authValueLen); 112| 0| } 113| 568| else 114| 568| return true; 115| 568|} acse.c:parseAarePdu: 185| 417|{ 186| 417| if (DEBUG_ACSE) ------------------ | | 32| 417|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 417] | | ------------------ ------------------ 187| 0| printf("ACSE: parse AARE PDU\n"); 188| | 189| 417| bool userInfoValid = false; 190| | 191| 417| uint32_t result = 99; 192| | 193| 272k| while (bufPos < maxBufPos) ------------------ | Branch (193:12): [True: 272k, False: 304] ------------------ 194| 272k| { 195| 272k| uint8_t tag = buffer[bufPos++]; 196| 272k| int len; 197| | 198| 272k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 199| | 200| 272k| if (bufPos < 0) ------------------ | Branch (200:13): [True: 64, False: 271k] ------------------ 201| 64| { 202| 64| if (DEBUG_ACSE) ------------------ | | 32| 64|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 64] | | ------------------ ------------------ 203| 0| printf("ACSE: Invalid PDU!\n"); 204| 64| return ACSE_ERROR; 205| 64| } 206| | 207| 271k| if (len == 0) ------------------ | Branch (207:13): [True: 7.54k, False: 264k] ------------------ 208| 7.54k| continue; 209| | 210| 264k| if (bufPos + len > maxBufPos) ------------------ | Branch (210:13): [True: 0, False: 264k] ------------------ 211| 0| { 212| 0| if (DEBUG_ACSE) ------------------ | | 32| 0|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 0] | | ------------------ ------------------ 213| 0| printf("ACSE: Invalid PDU!\n"); 214| 0| return ACSE_ERROR; 215| 0| } 216| | 217| 264k| switch (tag) 218| 264k| { 219| 5| case 0xa1: /* application context name */ ------------------ | Branch (219:9): [True: 5, False: 264k] ------------------ 220| 5| bufPos += len; 221| 5| break; 222| | 223| 884| case 0xa2: /* result */ ------------------ | Branch (223:9): [True: 884, False: 263k] ------------------ 224| 884| bufPos++; 225| | 226| 884| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 227| 884| if (bufPos < 0) ------------------ | Branch (227:17): [True: 1, False: 883] ------------------ 228| 1| return ACSE_ERROR; 229| | 230| 883| result = BerDecoder_decodeUint32(buffer, len, bufPos); 231| | 232| 883| bufPos += len; 233| 883| break; 234| | 235| 0| case 0xa3: /* result source diagnostic */ ------------------ | Branch (235:9): [True: 0, False: 264k] ------------------ 236| 0| bufPos += len; 237| 0| break; 238| | 239| 2.79k| case 0xbe: /* user information */ ------------------ | Branch (239:9): [True: 2.79k, False: 261k] ------------------ 240| 2.79k| if (buffer[bufPos] != 0x28) ------------------ | Branch (240:17): [True: 473, False: 2.32k] ------------------ 241| 473| { 242| 473| if (DEBUG_ACSE) ------------------ | | 32| 473|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 473] | | ------------------ ------------------ 243| 0| printf("ACSE: invalid user info\n"); 244| 473| bufPos += len; 245| 473| } 246| 2.32k| else 247| 2.32k| { 248| 2.32k| bufPos++; 249| | 250| 2.32k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 251| 2.32k| if (bufPos < 0) ------------------ | Branch (251:21): [True: 4, False: 2.32k] ------------------ 252| 4| return ACSE_ERROR; 253| | 254| 2.32k| bufPos = parseUserInformation(self, buffer, bufPos, bufPos + len, &userInfoValid); 255| 2.32k| if (bufPos < 0) ------------------ | Branch (255:21): [True: 44, False: 2.27k] ------------------ 256| 44| return ACSE_ERROR; 257| 2.32k| } 258| 2.75k| break; 259| | 260| 2.75k| case 0x00: /* indefinite length end tag -> ignore */ ------------------ | Branch (260:9): [True: 2.43k, False: 261k] ------------------ 261| 2.43k| break; 262| | 263| 258k| default: /* ignore unknown tag */ ------------------ | Branch (263:9): [True: 258k, False: 6.12k] ------------------ 264| 258k| if (DEBUG_ACSE) ------------------ | | 32| 258k|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 258k] | | ------------------ ------------------ 265| 0| printf("ACSE: parseAarePdu: unknown tag %02x\n", tag); 266| | 267| 258k| bufPos += len; 268| 258k| break; 269| 264k| } 270| 264k| } 271| | 272| 304| if (!userInfoValid) ------------------ | Branch (272:9): [True: 291, False: 13] ------------------ 273| 291| return ACSE_ERROR; 274| | 275| 13| if (result != 0) ------------------ | Branch (275:9): [True: 12, False: 1] ------------------ 276| 12| return ACSE_ASSOCIATE_FAILED; 277| | 278| 1| return ACSE_ASSOCIATE; 279| 13|}