LLVMFuzzerTestOneInput: 4| 1.32k|{ 5| 1.32k| AcseConnection acseConnection; 6| 1.32k| AcseConnection_init(&acseConnection, NULL, NULL, NULL); 7| | 8| 1.32k| ByteBuffer* acseBuffer = ByteBuffer_create(NULL, size); 9| 1.32k| ByteBuffer_append(acseBuffer, data, size); 10| 1.32k| AcseConnection_parseMessage(&acseConnection, acseBuffer); 11| | 12| 1.32k| ByteBuffer_destroy(acseBuffer); 13| 1.32k| return 0; 14| 1.32k|} Memory_calloc: 43| 2.65k|{ 44| 2.65k| void* memory = calloc(nmemb, size); 45| | 46| 2.65k| if (memory == NULL) ------------------ | Branch (46:9): [True: 0, False: 2.65k] ------------------ 47| 0| noMemoryAvailableHandler(); 48| | 49| 2.65k| return memory; 50| 2.65k|} Memory_free: 65| 2.65k|{ 66| 2.65k| free(memb); 67| 2.65k|} ByteBuffer_create: 29| 1.32k|{ 30| 1.32k| if (self == NULL) ------------------ | Branch (30:9): [True: 1.32k, False: 0] ------------------ 31| 1.32k| { 32| 1.32k| self = (ByteBuffer*)GLOBAL_CALLOC(1, sizeof(ByteBuffer)); ------------------ | | 20| 1.32k|#define GLOBAL_CALLOC(nmemb, size) Memory_calloc(nmemb, size) ------------------ 33| 1.32k| } 34| | 35| 1.32k| if (self) ------------------ | Branch (35:9): [True: 1.32k, False: 0] ------------------ 36| 1.32k| { 37| 1.32k| self->buffer = (uint8_t*)GLOBAL_CALLOC(maxSize, sizeof(uint8_t)); ------------------ | | 20| 1.32k|#define GLOBAL_CALLOC(nmemb, size) Memory_calloc(nmemb, size) ------------------ 38| | 39| 1.32k| if (self->buffer == NULL) ------------------ | Branch (39:13): [True: 0, False: 1.32k] ------------------ 40| 0| { 41| 0| GLOBAL_FREEMEM(self); ------------------ | | 23| 0|#define GLOBAL_FREEMEM(ptr) Memory_free(ptr) ------------------ 42| 0| self = NULL; 43| 0| } 44| 1.32k| else 45| 1.32k| { 46| 1.32k| self->maxSize = maxSize; 47| 1.32k| self->size = 0; 48| 1.32k| } 49| 1.32k| } 50| | 51| 1.32k| return self; 52| 1.32k|} ByteBuffer_destroy: 56| 1.32k|{ 57| 1.32k| GLOBAL_FREEMEM(self->buffer); ------------------ | | 23| 1.32k|#define GLOBAL_FREEMEM(ptr) Memory_free(ptr) ------------------ 58| 1.32k| GLOBAL_FREEMEM(self); ------------------ | | 23| 1.32k|#define GLOBAL_FREEMEM(ptr) Memory_free(ptr) ------------------ 59| 1.32k|} ByteBuffer_append: 71| 1.32k|{ 72| 1.32k| if (self->size + dataSize <= self->maxSize) ------------------ | Branch (72:9): [True: 1.32k, False: 0] ------------------ 73| 1.32k| { 74| 1.32k| memcpy(self->buffer + self->size, data, dataSize); 75| 1.32k| self->size += dataSize; 76| 1.32k| return dataSize; 77| 1.32k| } 78| 0| else 79| 0| { 80| 0| return -1; 81| 0| } 82| 1.32k|} BerDecoder_decodeLength: 128| 1.35M|{ 129| 1.35M| return BerDecoder_decodeLengthRecursive(buffer, length, bufPos, maxBufPos, 0, 50); 130| 1.35M|} BerDecoder_decodeUint32: 151| 93.2k|{ 152| 93.2k| uint32_t value = 0; 153| | 154| 93.2k| int i; 155| 211k| for (i = 0; i < intLen; i++) ------------------ | Branch (155:17): [True: 120k, False: 91.0k] ------------------ 156| 120k| { 157| 120k| value <<= 8; 158| 120k| value += buffer[bufPos + i]; 159| | 160| 120k| if (i == 3) ------------------ | Branch (160:13): [True: 2.21k, False: 118k] ------------------ 161| 2.21k| break; /* only accept up to 4 bytes for uint32 */ 162| 120k| } 163| | 164| 93.2k| return value; 165| 93.2k|} BerDecoder_decodeInt32: 169| 14.2k|{ 170| 14.2k| if ((intlen <= 0) || (intlen > 4)) ------------------ | Branch (170:9): [True: 7.90k, False: 6.31k] | Branch (170:26): [True: 204, False: 6.11k] ------------------ 171| 8.11k| return 0; 172| | 173| 6.11k| uint32_t value; 174| 6.11k| int i; 175| | 176| 6.11k| bool isNegative = ((buffer[bufPos] & 0x80) == 0x80); 177| | 178| 6.11k| if (isNegative) ------------------ | Branch (178:9): [True: 3.74k, False: 2.36k] ------------------ 179| 3.74k| value = -0xffffffff; /* initialize to all 1s for -1 */ 180| 2.36k| else 181| 2.36k| value = 0; 182| | 183| 12.4k| for (i = 0; i < intlen; i++) ------------------ | Branch (183:17): [True: 6.30k, False: 6.11k] ------------------ 184| 6.30k| { 185| 6.30k| value <<= 8; 186| 6.30k| value += buffer[bufPos + i]; 187| 6.30k| } 188| | 189| 6.11k| return (int32_t)value; 190| 14.2k|} BerDecoder_decodeOID: 256| 11.8k|{ 257| 11.8k| int startPos = bufPos; 258| 11.8k| int currentArc = 0; 259| | 260| | /* clear all arcs */ 261| 11.8k| int i; 262| 130k| for (i = 0; i < 10; i++) ------------------ | Branch (262:17): [True: 118k, False: 11.8k] ------------------ 263| 118k| oid->arc[i] = 0; 264| | 265| | /* parse first two arcs */ 266| 11.8k| if (length > 0) ------------------ | Branch (266:9): [True: 5.94k, False: 5.92k] ------------------ 267| 5.94k| { 268| 5.94k| oid->arc[0] = buffer[bufPos] / 40; 269| 5.94k| oid->arc[1] = buffer[bufPos] % 40; 270| | 271| 5.94k| currentArc = 2; 272| 5.94k| bufPos++; 273| 5.94k| } 274| | 275| | /* parse remaining arcs */ 276| 16.6k| while ((bufPos - startPos < length) && (currentArc < 10)) ------------------ | Branch (276:12): [True: 4.86k, False: 11.8k] | Branch (276:44): [True: 4.80k, False: 62] ------------------ 277| 4.80k| { 278| 4.80k| oid->arc[currentArc] = oid->arc[currentArc] << 7; 279| | 280| 4.80k| if (buffer[bufPos] < 0x80) ------------------ | Branch (280:13): [True: 3.51k, False: 1.28k] ------------------ 281| 3.51k| oid->arc[currentArc++] += buffer[bufPos]; 282| 1.28k| else 283| 1.28k| oid->arc[currentArc] += (buffer[bufPos] & 0x7f); 284| | 285| 4.80k| bufPos++; 286| 4.80k| } 287| | 288| 11.8k| oid->arcCount = currentArc; 289| 11.8k|} ber_decode.c:BerDecoder_decodeLengthRecursive: 75| 11.2M|{ 76| 11.2M| if (bufPos >= maxBufPos) ------------------ | Branch (76:9): [True: 265, False: 11.2M] ------------------ 77| 265| return -1; 78| | 79| 11.2M| uint8_t len1 = buffer[bufPos++]; 80| | 81| 11.2M| if (len1 & 0x80) ------------------ | Branch (81:9): [True: 354k, False: 10.8M] ------------------ 82| 354k| { 83| 354k| int lenLength = len1 & 0x7f; 84| | 85| 354k| if (lenLength == 0) ------------------ | Branch (85:13): [True: 53.5k, False: 301k] ------------------ 86| 53.5k| { /* indefinite length form */ 87| 53.5k| *length = getIndefiniteLength(buffer, bufPos, maxBufPos, depth, maxDepth); 88| 53.5k| } 89| 301k| else if (lenLength < 4) ------------------ | Branch (89:18): [True: 301k, False: 33] ------------------ 90| 301k| { 91| 301k| *length = 0; 92| | 93| 301k| int i; 94| 603k| for (i = 0; i < lenLength; i++) ------------------ | Branch (94:25): [True: 302k, False: 301k] ------------------ 95| 302k| { 96| 302k| if (bufPos >= maxBufPos) ------------------ | Branch (96:21): [True: 13, False: 302k] ------------------ 97| 13| return -1; 98| | 99| 302k| if (bufPos + (*length) > maxBufPos) ------------------ | Branch (99:21): [True: 1, False: 302k] ------------------ 100| 1| return -1; 101| | 102| 302k| *length <<= 8; 103| 302k| *length += buffer[bufPos++]; 104| 302k| } 105| 301k| } 106| 33| else 107| 33| { 108| | /* only accept a maximum of 3 length bytes*/ 109| 33| return -1; 110| 33| } 111| 354k| } 112| 10.8M| else 113| 10.8M| { 114| 10.8M| *length = len1; 115| 10.8M| } 116| | 117| 11.2M| if (*length < 0) ------------------ | Branch (117:9): [True: 1.41k, False: 11.2M] ------------------ 118| 1.41k| return -1; 119| | 120| 11.2M| if (bufPos + (*length) > maxBufPos) ------------------ | Branch (120:9): [True: 92, False: 11.2M] ------------------ 121| 92| return -1; 122| | 123| 11.2M| return bufPos; 124| 11.2M|} ber_decode.c:getIndefiniteLength: 32| 53.5k|{ 33| 53.5k| depth++; 34| | 35| 53.5k| if (depth > maxDepth) ------------------ | Branch (35:9): [True: 1, False: 53.5k] ------------------ 36| 1| return -1; 37| | 38| 53.5k| int length = 0; 39| | 40| 9.93M| while (bufPos < maxBufPos) ------------------ | Branch (40:12): [True: 9.93M, False: 45] ------------------ 41| 9.93M| { 42| 9.93M| if ((buffer[bufPos] == 0) && ((bufPos + 1) < maxBufPos) && (buffer[bufPos + 1] == 0)) ------------------ | Branch (42:13): [True: 500k, False: 9.43M] | Branch (42:38): [True: 500k, False: 18] | Branch (42:68): [True: 52.1k, False: 448k] ------------------ 43| 52.1k| { 44| 52.1k| return length + 2; 45| 52.1k| } 46| 9.88M| else 47| 9.88M| { 48| 9.88M| length++; 49| | 50| 9.88M| if ((buffer[bufPos++] & 0x1f) == 0x1f) ------------------ | Branch (50:17): [True: 430k, False: 9.45M] ------------------ 51| 430k| { 52| | /* handle extended tags */ 53| 430k| bufPos++; 54| 430k| length++; 55| 430k| } 56| | 57| 9.88M| int subLength = -1; 58| | 59| 9.88M| int newBufPos = BerDecoder_decodeLengthRecursive(buffer, &subLength, bufPos, maxBufPos, depth, maxDepth); 60| | 61| 9.88M| if (newBufPos == -1) ------------------ | Branch (61:17): [True: 1.37k, False: 9.88M] ------------------ 62| 1.37k| return -1; 63| | 64| 9.88M| length += subLength + newBufPos - bufPos; 65| | 66| 9.88M| bufPos = newBufPos + subLength; 67| 9.88M| } 68| 9.93M| } 69| | 70| 45| return -1; 71| 53.5k|} AcseConnection_init: 450| 1.32k|{ 451| 1.32k| self->state = idle; 452| 1.32k| self->nextReference = 0; 453| 1.32k| self->userDataBuffer = NULL; 454| 1.32k| self->userDataBufferSize = 0; 455| 1.32k| self->authenticator = authenticator; 456| 1.32k| self->authenticatorParameter = parameter; 457| | 458| |#if (CONFIG_MMS_SUPPORT_TLS == 1) 459| | self->tlsSocket = tlsSocket; 460| |#else 461| 1.32k| (void)tlsSocket; 462| 1.32k|#endif 463| | 464| 1.32k| memset(&(self->applicationReference), 0, 465| 1.32k| sizeof(self->applicationReference)); 466| 1.32k|} AcseConnection_parseMessage: 470| 1.32k|{ 471| 1.32k| AcseIndication indication = ACSE_ERROR; 472| | 473| 1.32k| if (message == NULL || message->size < 1) ------------------ | Branch (473:9): [True: 0, False: 1.32k] | Branch (473:28): [True: 0, False: 1.32k] ------------------ 474| 0| { 475| 0| if (DEBUG_ACSE) ------------------ | | 32| 0|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 0] | | ------------------ ------------------ 476| 0| printf("ACSE: invalid message - no payload\n"); 477| | 478| 0| return ACSE_ERROR; 479| 0| } 480| | 481| 1.32k| uint8_t* buffer = message->buffer; 482| | 483| 1.32k| int messageSize = message->size; 484| | 485| 1.32k| int bufPos = 0; 486| | 487| 1.32k| uint8_t messageType = buffer[bufPos++]; 488| | 489| 1.32k| int len; 490| | 491| 1.32k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, messageSize); 492| | 493| 1.32k| if (bufPos < 0) ------------------ | Branch (493:9): [True: 230, False: 1.09k] ------------------ 494| 230| { 495| 230| if (DEBUG_ACSE) ------------------ | | 32| 230|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 230] | | ------------------ ------------------ 496| 0| printf("ACSE: AcseConnection_parseMessage: invalid ACSE message!\n"); 497| | 498| 230| return ACSE_ERROR; 499| 230| } 500| | 501| 1.09k| switch (messageType) 502| 1.09k| { 503| 683| case 0x60: ------------------ | Branch (503:5): [True: 683, False: 414] ------------------ 504| 683| indication = parseAarqPdu(self, buffer, bufPos, bufPos + len); 505| 683| break; 506| 406| case 0x61: ------------------ | Branch (506:5): [True: 406, False: 691] ------------------ 507| 406| indication = parseAarePdu(self, buffer, bufPos, bufPos + len); 508| 406| break; 509| 2| case 0x62: /* A_RELEASE.request RLRQ-apdu */ ------------------ | Branch (509:5): [True: 2, False: 1.09k] ------------------ 510| 2| indication = ACSE_RELEASE_REQUEST; 511| 2| break; 512| 1| case 0x63: /* A_RELEASE.response RLRE-apdu */ ------------------ | Branch (512:5): [True: 1, False: 1.09k] ------------------ 513| 1| indication = ACSE_RELEASE_RESPONSE; 514| 1| break; 515| 1| case 0x64: /* A_ABORT */ ------------------ | Branch (515:5): [True: 1, False: 1.09k] ------------------ 516| 1| indication = ACSE_ABORT; 517| 1| break; 518| 1| case 0x00: /* indefinite length end tag -> ignore */ ------------------ | Branch (518:5): [True: 1, False: 1.09k] ------------------ 519| 1| break; 520| 3| default: ------------------ | Branch (520:5): [True: 3, False: 1.09k] ------------------ 521| 3| if (DEBUG_ACSE) ------------------ | | 32| 3|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 3] | | ------------------ ------------------ 522| 0| printf("ACSE: Unknown ACSE message\n"); 523| 3| indication = ACSE_ERROR; 524| 3| break; 525| 1.09k| } 526| | 527| 1.09k| return indication; 528| 1.09k|} acse.c:parseAarqPdu: 283| 683|{ 284| 683| if (DEBUG_ACSE) ------------------ | | 32| 683|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 683] | | ------------------ ------------------ 285| 0| printf("ACSE: parse AARQ PDU\n"); 286| | 287| 683| uint8_t* authValue = NULL; 288| 683| int authValueLen = 0; 289| 683| uint8_t* authMechanism = NULL; 290| 683| int authMechLen = 0; 291| 683| bool userInfoValid = false; 292| | 293| 521k| while (bufPos < maxBufPos) ------------------ | Branch (293:12): [True: 521k, False: 577] ------------------ 294| 521k| { 295| 521k| uint8_t tag = buffer[bufPos++]; 296| 521k| int len; 297| | 298| 521k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 299| | 300| 521k| if (bufPos < 0) ------------------ | Branch (300:13): [True: 62, False: 521k] ------------------ 301| 62| { 302| 62| if (DEBUG_ACSE) ------------------ | | 32| 62|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 62] | | ------------------ ------------------ 303| 0| printf("ACSE: Invalid PDU!\n"); 304| 62| return ACSE_ASSOCIATE_FAILED; 305| 62| } 306| | 307| 521k| if (len == 0) ------------------ | Branch (307:13): [True: 11.8k, False: 509k] ------------------ 308| 11.8k| continue; 309| | 310| 509k| if (bufPos + len > maxBufPos) ------------------ | Branch (310:13): [True: 0, False: 509k] ------------------ 311| 0| { 312| 0| if (DEBUG_ACSE) ------------------ | | 32| 0|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 0] | | ------------------ ------------------ 313| 0| printf("ACSE: Invalid PDU!\n"); 314| 0| return ACSE_ASSOCIATE_FAILED; 315| 0| } 316| | 317| 509k| switch (tag) 318| 509k| { 319| 0| case 0xa1: /* application context name */ ------------------ | Branch (319:9): [True: 0, False: 509k] ------------------ 320| 0| bufPos += len; 321| 0| break; 322| | 323| 216| case 0xa2: /* called AP title */ ------------------ | Branch (323:9): [True: 216, False: 509k] ------------------ 324| 216| bufPos += len; 325| 216| break; 326| 0| case 0xa3: /* called AE qualifier */ ------------------ | Branch (326:9): [True: 0, False: 509k] ------------------ 327| 0| bufPos += len; 328| 0| break; 329| | 330| 16.3k| case 0xa6: /* calling AP title */ ------------------ | Branch (330:9): [True: 16.3k, False: 492k] ------------------ 331| 16.3k| { 332| 16.3k| if (len >= 2 && buffer[bufPos] == 0x06) ------------------ | Branch (332:21): [True: 13.5k, False: 2.75k] | Branch (332:33): [True: 12.4k, False: 1.09k] ------------------ 333| 12.4k| { 334| | /* ap-title-form2 */ 335| | 336| 12.4k| int innerLength = buffer[bufPos + 1]; 337| | 338| 12.4k| if ((innerLength >= 0) && (innerLength == len - 2)) ------------------ | Branch (338:25): [True: 12.4k, False: 0] | Branch (338:47): [True: 11.8k, False: 597] ------------------ 339| 11.8k| BerDecoder_decodeOID(buffer, bufPos + 2, innerLength, &(self->applicationReference.apTitle)); 340| 12.4k| } 341| 16.3k| } 342| 16.3k| bufPos += len; 343| 16.3k| break; 344| | 345| 21.0k| case 0xa7: /* calling AE qualifier */ ------------------ | Branch (345:9): [True: 21.0k, False: 488k] ------------------ 346| 21.0k| { 347| 21.0k| if (len >= 2 && buffer[bufPos] == 0x02) ------------------ | Branch (347:21): [True: 20.6k, False: 383] | Branch (347:33): [True: 17.5k, False: 3.16k] ------------------ 348| 17.5k| { 349| | /* ae-qualifier-form2 */ 350| | 351| 17.5k| int innerLength = buffer[bufPos + 1]; 352| | 353| 17.5k| if ((innerLength >= 0) && (innerLength == len - 2)) ------------------ | Branch (353:25): [True: 17.5k, False: 0] | Branch (353:47): [True: 14.2k, False: 3.31k] ------------------ 354| 14.2k| self->applicationReference.aeQualifier = BerDecoder_decodeInt32(buffer, innerLength, bufPos + 2); 355| 17.5k| } 356| 21.0k| } 357| 21.0k| bufPos += len; 358| 21.0k| break; 359| | 360| 0| case 0x8a: /* sender ACSE requirements */ ------------------ | Branch (360:9): [True: 0, False: 509k] ------------------ 361| 0| bufPos += len; 362| 0| break; 363| | 364| 232| case 0x8b: /* (authentication) mechanism name */ ------------------ | Branch (364:9): [True: 232, False: 509k] ------------------ 365| 232| authMechLen = len; 366| 232| authMechanism = buffer + bufPos; 367| 232| bufPos += len; 368| 232| break; 369| | 370| 716| case 0xac: /* authentication value */ ------------------ | Branch (370:9): [True: 716, False: 508k] ------------------ 371| 716| bufPos++; 372| | 373| 716| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 374| 716| if (bufPos < 0) ------------------ | Branch (374:17): [True: 2, False: 714] ------------------ 375| 2| { 376| 2| if (DEBUG_ACSE) ------------------ | | 32| 2|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 2] | | ------------------ ------------------ 377| 0| printf("ACSE: Invalid PDU!\n"); 378| 2| return ACSE_ASSOCIATE_FAILED; 379| 2| } 380| | 381| 714| authValueLen = len; 382| 714| authValue = buffer + bufPos; 383| 714| bufPos += len; 384| 714| break; 385| | 386| 6.11k| case 0xbe: /* user information */ ------------------ | Branch (386:9): [True: 6.11k, False: 503k] ------------------ 387| 6.11k| if (buffer[bufPos] != 0x28) ------------------ | Branch (387:17): [True: 1.14k, False: 4.97k] ------------------ 388| 1.14k| { 389| 1.14k| if (DEBUG_ACSE) ------------------ | | 32| 1.14k|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 1.14k] | | ------------------ ------------------ 390| 0| printf("ACSE: invalid user info\n"); 391| 1.14k| bufPos += len; 392| 1.14k| } 393| 4.97k| else 394| 4.97k| { 395| 4.97k| bufPos++; 396| | 397| 4.97k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 398| | 399| 4.97k| if (bufPos < 0) ------------------ | Branch (399:21): [True: 3, False: 4.97k] ------------------ 400| 3| { 401| 3| if (DEBUG_ACSE) ------------------ | | 32| 3|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 3] | | ------------------ ------------------ 402| 0| printf("ACSE: Invalid PDU!\n"); 403| 3| return ACSE_ASSOCIATE_FAILED; 404| 3| } 405| | 406| 4.97k| bufPos = parseUserInformation(self, buffer, bufPos, bufPos + len, &userInfoValid); 407| | 408| 4.97k| if (bufPos < 0) ------------------ | Branch (408:21): [True: 39, False: 4.93k] ------------------ 409| 39| { 410| 39| if (DEBUG_ACSE) ------------------ | | 32| 39|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 39] | | ------------------ ------------------ 411| 0| printf("ACSE: Invalid PDU!\n"); 412| 39| return ACSE_ASSOCIATE_FAILED; 413| 39| } 414| 4.97k| } 415| 6.07k| break; 416| | 417| 6.07k| case 0x00: /* indefinite length end tag -> ignore */ ------------------ | Branch (417:9): [True: 3.26k, False: 506k] ------------------ 418| 3.26k| break; 419| | 420| 461k| default: /* ignore unknown tag */ ------------------ | Branch (420:9): [True: 461k, False: 47.9k] ------------------ 421| 461k| if (DEBUG_ACSE) ------------------ | | 32| 461k|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 461k] | | ------------------ ------------------ 422| 0| printf("ACSE: parseAarqPdu: unknown tag %02x\n", tag); 423| | 424| 461k| bufPos += len; 425| 461k| break; 426| 509k| } 427| 509k| } 428| | 429| 577| if (checkAuthentication(self, authMechanism, authMechLen, authValue, authValueLen) == false) ------------------ | Branch (429:9): [True: 0, False: 577] ------------------ 430| 0| { 431| 0| if (DEBUG_ACSE) ------------------ | | 32| 0|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 0] | | ------------------ ------------------ 432| 0| printf("ACSE: parseAarqPdu: check authentication failed!\n"); 433| | 434| 0| return ACSE_ASSOCIATE_FAILED; 435| 0| } 436| | 437| 577| if (userInfoValid == false) ------------------ | Branch (437:9): [True: 566, False: 11] ------------------ 438| 566| { 439| 566| if (DEBUG_ACSE) ------------------ | | 32| 566|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 566] | | ------------------ ------------------ 440| 0| printf("ACSE: parseAarqPdu: user info invalid!\n"); 441| | 442| 566| return ACSE_ASSOCIATE_FAILED; 443| 566| } 444| | 445| 11| return ACSE_ASSOCIATE; 446| 577|} acse.c:parseUserInformation: 119| 8.88k|{ 120| 8.88k| if (DEBUG_ACSE) ------------------ | | 32| 8.88k|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 8.88k] | | ------------------ ------------------ 121| 0| printf("ACSE: parseUserInformation %i %i\n", bufPos, maxBufPos); 122| | 123| 8.88k| bool hasindirectReference = false; 124| 8.88k| bool isDataValid = false; 125| | 126| 153k| while (bufPos < maxBufPos) ------------------ | Branch (126:12): [True: 144k, False: 8.80k] ------------------ 127| 144k| { 128| 144k| uint8_t tag = buffer[bufPos++]; 129| 144k| int len; 130| | 131| 144k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 132| | 133| 144k| if ((bufPos < 0) || (bufPos + len > maxBufPos)) ------------------ | Branch (133:13): [True: 81, False: 144k] | Branch (133:29): [True: 0, False: 144k] ------------------ 134| 81| { 135| 81| *userInfoValid = false; 136| 81| return -1; 137| 81| } 138| | 139| 144k| if (len == 0) ------------------ | Branch (139:13): [True: 16.3k, False: 127k] ------------------ 140| 16.3k| continue; 141| | 142| 127k| switch (tag) 143| 127k| { 144| | 145| 90.4k| case 0x02: /* indirect-reference */ ------------------ | Branch (145:9): [True: 90.4k, False: 37.5k] ------------------ 146| 90.4k| self->nextReference = BerDecoder_decodeUint32(buffer, len, bufPos); 147| 90.4k| bufPos += len; 148| 90.4k| hasindirectReference = true; 149| 90.4k| break; 150| | 151| 1.05k| case 0xa0: /* encoding */ ------------------ | Branch (151:9): [True: 1.05k, False: 126k] ------------------ 152| 1.05k| isDataValid = true; 153| | 154| 1.05k| self->userDataBufferSize = len; 155| 1.05k| self->userDataBuffer = buffer + bufPos; 156| | 157| 1.05k| bufPos += len; 158| | 159| 1.05k| break; 160| | 161| 36.5k| default: /* ignore unknown tag */ ------------------ | Branch (161:9): [True: 36.5k, False: 91.4k] ------------------ 162| 36.5k| bufPos += len; 163| 127k| } 164| 127k| } 165| | 166| 8.80k| if (DEBUG_ACSE) ------------------ | | 32| 8.80k|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 8.80k] | | ------------------ ------------------ 167| 0| { 168| 0| if (!hasindirectReference) ------------------ | Branch (168:13): [True: 0, False: 0] ------------------ 169| 0| printf("ACSE: User data has no indirect reference!\n"); 170| | 171| 0| if (!isDataValid) ------------------ | Branch (171:13): [True: 0, False: 0] ------------------ 172| 0| printf("ACSE: No valid user data\n"); 173| 0| } 174| | 175| 8.80k| if (hasindirectReference && isDataValid) ------------------ | Branch (175:9): [True: 5.62k, False: 3.17k] | Branch (175:33): [True: 497, False: 5.12k] ------------------ 176| 497| *userInfoValid = true; 177| 8.30k| else 178| 8.30k| *userInfoValid = false; 179| | 180| 8.80k| return bufPos; 181| 8.88k|} acse.c:checkAuthentication: 84| 577|{ 85| 577| self->securityToken = NULL; 86| | 87| 577| if (self->authenticator != NULL) ------------------ | Branch (87:9): [True: 0, False: 577] ------------------ 88| 0| { 89| 0| AcseAuthenticationMechanism mechanism = checkAuthMechanismName(authMechanism, authMechLen); 90| | 91| 0| if (mechanism == ACSE_AUTH_NONE) ------------------ | Branch (91:13): [True: 0, False: 0] ------------------ 92| 0| { 93| |#if (CONFIG_MMS_SUPPORT_TLS == 1) 94| | if (self->tlsSocket) 95| | { 96| | int certLen; 97| | 98| | uint8_t* certBuf = TLSSocket_getPeerCertificate(self->tlsSocket, &certLen); 99| | 100| | if (certBuf) { 101| | mechanism = ACSE_AUTH_TLS; 102| | authValue = certBuf; 103| | authValueLen = certLen; 104| | } 105| | 106| | } 107| |#endif /* (CONFIG_MMS_SUPPORT_TLS == 1) */ 108| | 109| 0| } 110| | 111| 0| return authenticateClient(self, mechanism, authValue, authValueLen); 112| 0| } 113| 577| else 114| 577| return true; 115| 577|} acse.c:parseAarePdu: 185| 406|{ 186| 406| if (DEBUG_ACSE) ------------------ | | 32| 406|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 406] | | ------------------ ------------------ 187| 0| printf("ACSE: parse AARE PDU\n"); 188| | 189| 406| bool userInfoValid = false; 190| | 191| 406| uint32_t result = 99; 192| | 193| 679k| while (bufPos < maxBufPos) ------------------ | Branch (193:12): [True: 678k, False: 292] ------------------ 194| 678k| { 195| 678k| uint8_t tag = buffer[bufPos++]; 196| 678k| int len; 197| | 198| 678k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 199| | 200| 678k| if (bufPos < 0) ------------------ | Branch (200:13): [True: 63, False: 678k] ------------------ 201| 63| { 202| 63| if (DEBUG_ACSE) ------------------ | | 32| 63|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 63] | | ------------------ ------------------ 203| 0| printf("ACSE: Invalid PDU!\n"); 204| 63| return ACSE_ERROR; 205| 63| } 206| | 207| 678k| if (len == 0) ------------------ | Branch (207:13): [True: 15.8k, False: 663k] ------------------ 208| 15.8k| continue; 209| | 210| 663k| if (bufPos + len > maxBufPos) ------------------ | Branch (210:13): [True: 0, False: 663k] ------------------ 211| 0| { 212| 0| if (DEBUG_ACSE) ------------------ | | 32| 0|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 0] | | ------------------ ------------------ 213| 0| printf("ACSE: Invalid PDU!\n"); 214| 0| return ACSE_ERROR; 215| 0| } 216| | 217| 663k| switch (tag) 218| 663k| { 219| 11| case 0xa1: /* application context name */ ------------------ | Branch (219:9): [True: 11, False: 662k] ------------------ 220| 11| bufPos += len; 221| 11| break; 222| | 223| 2.84k| case 0xa2: /* result */ ------------------ | Branch (223:9): [True: 2.84k, False: 660k] ------------------ 224| 2.84k| bufPos++; 225| | 226| 2.84k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 227| 2.84k| if (bufPos < 0) ------------------ | Branch (227:17): [True: 5, False: 2.84k] ------------------ 228| 5| return ACSE_ERROR; 229| | 230| 2.84k| result = BerDecoder_decodeUint32(buffer, len, bufPos); 231| | 232| 2.84k| bufPos += len; 233| 2.84k| break; 234| | 235| 0| case 0xa3: /* result source diagnostic */ ------------------ | Branch (235:9): [True: 0, False: 663k] ------------------ 236| 0| bufPos += len; 237| 0| break; 238| | 239| 4.56k| case 0xbe: /* user information */ ------------------ | Branch (239:9): [True: 4.56k, False: 658k] ------------------ 240| 4.56k| if (buffer[bufPos] != 0x28) ------------------ | Branch (240:17): [True: 653, False: 3.91k] ------------------ 241| 653| { 242| 653| if (DEBUG_ACSE) ------------------ | | 32| 653|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 653] | | ------------------ ------------------ 243| 0| printf("ACSE: invalid user info\n"); 244| 653| bufPos += len; 245| 653| } 246| 3.91k| else 247| 3.91k| { 248| 3.91k| bufPos++; 249| | 250| 3.91k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 251| 3.91k| if (bufPos < 0) ------------------ | Branch (251:21): [True: 4, False: 3.90k] ------------------ 252| 4| return ACSE_ERROR; 253| | 254| 3.90k| bufPos = parseUserInformation(self, buffer, bufPos, bufPos + len, &userInfoValid); 255| 3.90k| if (bufPos < 0) ------------------ | Branch (255:21): [True: 42, False: 3.86k] ------------------ 256| 42| return ACSE_ERROR; 257| 3.90k| } 258| 4.51k| break; 259| | 260| 4.51k| case 0x00: /* indefinite length end tag -> ignore */ ------------------ | Branch (260:9): [True: 4.34k, False: 658k] ------------------ 261| 4.34k| break; 262| | 263| 651k| default: /* ignore unknown tag */ ------------------ | Branch (263:9): [True: 651k, False: 11.7k] ------------------ 264| 651k| if (DEBUG_ACSE) ------------------ | | 32| 651k|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 651k] | | ------------------ ------------------ 265| 0| printf("ACSE: parseAarePdu: unknown tag %02x\n", tag); 266| | 267| 651k| bufPos += len; 268| 651k| break; 269| 663k| } 270| 663k| } 271| | 272| 292| if (!userInfoValid) ------------------ | Branch (272:9): [True: 277, False: 15] ------------------ 273| 277| return ACSE_ERROR; 274| | 275| 15| if (result != 0) ------------------ | Branch (275:9): [True: 14, False: 1] ------------------ 276| 14| return ACSE_ASSOCIATE_FAILED; 277| | 278| 1| return ACSE_ASSOCIATE; 279| 15|}