LLVMFuzzerTestOneInput: 4| 1.31k|{ 5| 1.31k| AcseConnection acseConnection; 6| 1.31k| AcseConnection_init(&acseConnection, NULL, NULL, NULL); 7| | 8| 1.31k| ByteBuffer* acseBuffer = ByteBuffer_create(NULL, size); 9| 1.31k| ByteBuffer_append(acseBuffer, data, size); 10| 1.31k| AcseConnection_parseMessage(&acseConnection, acseBuffer); 11| | 12| 1.31k| ByteBuffer_destroy(acseBuffer); 13| 1.31k| return 0; 14| 1.31k|} Memory_calloc: 43| 2.62k|{ 44| 2.62k| void* memory = calloc(nmemb, size); 45| | 46| 2.62k| if (memory == NULL) ------------------ | Branch (46:9): [True: 0, False: 2.62k] ------------------ 47| 0| noMemoryAvailableHandler(); 48| | 49| 2.62k| return memory; 50| 2.62k|} Memory_free: 65| 2.62k|{ 66| 2.62k| free(memb); 67| 2.62k|} ByteBuffer_create: 29| 1.31k|{ 30| 1.31k| if (self == NULL) ------------------ | Branch (30:9): [True: 1.31k, False: 0] ------------------ 31| 1.31k| { 32| 1.31k| self = (ByteBuffer*)GLOBAL_CALLOC(1, sizeof(ByteBuffer)); ------------------ | | 20| 1.31k|#define GLOBAL_CALLOC(nmemb, size) Memory_calloc(nmemb, size) ------------------ 33| 1.31k| } 34| | 35| 1.31k| if (self) ------------------ | Branch (35:9): [True: 1.31k, False: 0] ------------------ 36| 1.31k| { 37| 1.31k| self->buffer = (uint8_t*)GLOBAL_CALLOC(maxSize, sizeof(uint8_t)); ------------------ | | 20| 1.31k|#define GLOBAL_CALLOC(nmemb, size) Memory_calloc(nmemb, size) ------------------ 38| | 39| 1.31k| if (self->buffer == NULL) ------------------ | Branch (39:13): [True: 0, False: 1.31k] ------------------ 40| 0| { 41| 0| GLOBAL_FREEMEM(self); ------------------ | | 23| 0|#define GLOBAL_FREEMEM(ptr) Memory_free(ptr) ------------------ 42| 0| self = NULL; 43| 0| } 44| 1.31k| else 45| 1.31k| { 46| 1.31k| self->maxSize = maxSize; 47| 1.31k| self->size = 0; 48| 1.31k| } 49| 1.31k| } 50| | 51| 1.31k| return self; 52| 1.31k|} ByteBuffer_destroy: 56| 1.31k|{ 57| 1.31k| GLOBAL_FREEMEM(self->buffer); ------------------ | | 23| 1.31k|#define GLOBAL_FREEMEM(ptr) Memory_free(ptr) ------------------ 58| 1.31k| GLOBAL_FREEMEM(self); ------------------ | | 23| 1.31k|#define GLOBAL_FREEMEM(ptr) Memory_free(ptr) ------------------ 59| 1.31k|} ByteBuffer_append: 71| 1.31k|{ 72| 1.31k| if (self->size + dataSize <= self->maxSize) ------------------ | Branch (72:9): [True: 1.31k, False: 0] ------------------ 73| 1.31k| { 74| 1.31k| memcpy(self->buffer + self->size, data, dataSize); 75| 1.31k| self->size += dataSize; 76| 1.31k| return dataSize; 77| 1.31k| } 78| 0| else 79| 0| { 80| 0| return -1; 81| 0| } 82| 1.31k|} BerDecoder_decodeLength: 128| 1.29M|{ 129| 1.29M| return BerDecoder_decodeLengthRecursive(buffer, length, bufPos, maxBufPos, 0, 50); 130| 1.29M|} BerDecoder_decodeUint32: 151| 126k|{ 152| 126k| uint32_t value = 0; 153| | 154| 126k| int i; 155| 279k| for (i = 0; i < intLen; i++) ------------------ | Branch (155:17): [True: 155k, False: 123k] ------------------ 156| 155k| { 157| 155k| value <<= 8; 158| 155k| value += buffer[bufPos + i]; 159| | 160| 155k| if (i == 3) ------------------ | Branch (160:13): [True: 2.83k, False: 152k] ------------------ 161| 2.83k| break; /* only accept up to 4 bytes for uint32 */ 162| 155k| } 163| | 164| 126k| return value; 165| 126k|} BerDecoder_decodeInt32: 169| 24.1k|{ 170| 24.1k| if ((intlen <= 0) || (intlen > 4)) ------------------ | Branch (170:9): [True: 17.0k, False: 7.12k] | Branch (170:26): [True: 207, False: 6.91k] ------------------ 171| 17.2k| return 0; 172| | 173| 6.91k| uint32_t value; 174| 6.91k| int i; 175| | 176| 6.91k| bool isNegative = ((buffer[bufPos] & 0x80) == 0x80); 177| | 178| 6.91k| if (isNegative) ------------------ | Branch (178:9): [True: 4.78k, False: 2.13k] ------------------ 179| 4.78k| value = -0xffffffff; /* initialize to all 1s for -1 */ 180| 2.13k| else 181| 2.13k| value = 0; 182| | 183| 14.0k| for (i = 0; i < intlen; i++) ------------------ | Branch (183:17): [True: 7.14k, False: 6.91k] ------------------ 184| 7.14k| { 185| 7.14k| value <<= 8; 186| 7.14k| value += buffer[bufPos + i]; 187| 7.14k| } 188| | 189| 6.91k| return (int32_t)value; 190| 24.1k|} BerDecoder_decodeOID: 256| 27.8k|{ 257| 27.8k| int startPos = bufPos; 258| 27.8k| int currentArc = 0; 259| | 260| | /* clear all arcs */ 261| 27.8k| int i; 262| 306k| for (i = 0; i < 10; i++) ------------------ | Branch (262:17): [True: 278k, False: 27.8k] ------------------ 263| 278k| oid->arc[i] = 0; 264| | 265| | /* parse first two arcs */ 266| 27.8k| if (length > 0) ------------------ | Branch (266:9): [True: 15.6k, False: 12.1k] ------------------ 267| 15.6k| { 268| 15.6k| oid->arc[0] = buffer[bufPos] / 40; 269| 15.6k| oid->arc[1] = buffer[bufPos] % 40; 270| | 271| 15.6k| currentArc = 2; 272| 15.6k| bufPos++; 273| 15.6k| } 274| | 275| | /* parse remaining arcs */ 276| 33.5k| while ((bufPos - startPos < length) && (currentArc < 10)) ------------------ | Branch (276:12): [True: 5.66k, False: 27.8k] | Branch (276:44): [True: 5.64k, False: 15] ------------------ 277| 5.64k| { 278| 5.64k| oid->arc[currentArc] = oid->arc[currentArc] << 7; 279| | 280| 5.64k| if (buffer[bufPos] < 0x80) ------------------ | Branch (280:13): [True: 4.48k, False: 1.15k] ------------------ 281| 4.48k| oid->arc[currentArc++] += buffer[bufPos]; 282| 1.15k| else 283| 1.15k| oid->arc[currentArc] += (buffer[bufPos] & 0x7f); 284| | 285| 5.64k| bufPos++; 286| 5.64k| } 287| | 288| 27.8k| oid->arcCount = currentArc; 289| 27.8k|} ber_decode.c:BerDecoder_decodeLengthRecursive: 75| 10.6M|{ 76| 10.6M| if (bufPos >= maxBufPos) ------------------ | Branch (76:9): [True: 278, False: 10.6M] ------------------ 77| 278| return -1; 78| | 79| 10.6M| uint8_t len1 = buffer[bufPos++]; 80| | 81| 10.6M| if (len1 & 0x80) ------------------ | Branch (81:9): [True: 334k, False: 10.2M] ------------------ 82| 334k| { 83| 334k| int lenLength = len1 & 0x7f; 84| | 85| 334k| if (lenLength == 0) ------------------ | Branch (85:13): [True: 55.2k, False: 279k] ------------------ 86| 55.2k| { /* indefinite length form */ 87| 55.2k| *length = getIndefiniteLength(buffer, bufPos, maxBufPos, depth, maxDepth); 88| 55.2k| } 89| 279k| else if (lenLength < 4) ------------------ | Branch (89:18): [True: 279k, False: 29] ------------------ 90| 279k| { 91| 279k| *length = 0; 92| | 93| 279k| int i; 94| 560k| for (i = 0; i < lenLength; i++) ------------------ | Branch (94:25): [True: 280k, False: 279k] ------------------ 95| 280k| { 96| 280k| if (bufPos >= maxBufPos) ------------------ | Branch (96:21): [True: 12, False: 280k] ------------------ 97| 12| return -1; 98| | 99| 280k| if (bufPos + (*length) > maxBufPos) ------------------ | Branch (99:21): [True: 1, False: 280k] ------------------ 100| 1| return -1; 101| | 102| 280k| *length <<= 8; 103| 280k| *length += buffer[bufPos++]; 104| 280k| } 105| 279k| } 106| 29| else 107| 29| { 108| | /* only accept a maximum of 3 length bytes*/ 109| 29| return -1; 110| 29| } 111| 334k| } 112| 10.2M| else 113| 10.2M| { 114| 10.2M| *length = len1; 115| 10.2M| } 116| | 117| 10.6M| if (*length < 0) ------------------ | Branch (117:9): [True: 1.36k, False: 10.6M] ------------------ 118| 1.36k| return -1; 119| | 120| 10.6M| if (bufPos + (*length) > maxBufPos) ------------------ | Branch (120:9): [True: 84, False: 10.6M] ------------------ 121| 84| return -1; 122| | 123| 10.6M| return bufPos; 124| 10.6M|} ber_decode.c:getIndefiniteLength: 32| 55.2k|{ 33| 55.2k| depth++; 34| | 35| 55.2k| if (depth > maxDepth) ------------------ | Branch (35:9): [True: 1, False: 55.2k] ------------------ 36| 1| return -1; 37| | 38| 55.2k| int length = 0; 39| | 40| 9.38M| while (bufPos < maxBufPos) ------------------ | Branch (40:12): [True: 9.38M, False: 38] ------------------ 41| 9.38M| { 42| 9.38M| if ((buffer[bufPos] == 0) && ((bufPos + 1) < maxBufPos) && (buffer[bufPos + 1] == 0)) ------------------ | Branch (42:13): [True: 538k, False: 8.85M] | Branch (42:38): [True: 538k, False: 21] | Branch (42:68): [True: 53.8k, False: 484k] ------------------ 43| 53.8k| { 44| 53.8k| return length + 2; 45| 53.8k| } 46| 9.33M| else 47| 9.33M| { 48| 9.33M| length++; 49| | 50| 9.33M| if ((buffer[bufPos++] & 0x1f) == 0x1f) ------------------ | Branch (50:17): [True: 429k, False: 8.90M] ------------------ 51| 429k| { 52| | /* handle extended tags */ 53| 429k| bufPos++; 54| 429k| length++; 55| 429k| } 56| | 57| 9.33M| int subLength = -1; 58| | 59| 9.33M| int newBufPos = BerDecoder_decodeLengthRecursive(buffer, &subLength, bufPos, maxBufPos, depth, maxDepth); 60| | 61| 9.33M| if (newBufPos == -1) ------------------ | Branch (61:17): [True: 1.32k, False: 9.33M] ------------------ 62| 1.32k| return -1; 63| | 64| 9.33M| length += subLength + newBufPos - bufPos; 65| | 66| 9.33M| bufPos = newBufPos + subLength; 67| 9.33M| } 68| 9.38M| } 69| | 70| 38| return -1; 71| 55.2k|} AcseConnection_init: 450| 1.31k|{ 451| 1.31k| self->state = idle; 452| 1.31k| self->nextReference = 0; 453| 1.31k| self->userDataBuffer = NULL; 454| 1.31k| self->userDataBufferSize = 0; 455| 1.31k| self->authenticator = authenticator; 456| 1.31k| self->authenticatorParameter = parameter; 457| | 458| |#if (CONFIG_MMS_SUPPORT_TLS == 1) 459| | self->tlsSocket = tlsSocket; 460| |#else 461| 1.31k| (void)tlsSocket; 462| 1.31k|#endif 463| | 464| 1.31k| memset(&(self->applicationReference), 0, 465| 1.31k| sizeof(self->applicationReference)); 466| 1.31k|} AcseConnection_parseMessage: 470| 1.31k|{ 471| 1.31k| AcseIndication indication = ACSE_ERROR; 472| | 473| 1.31k| if (message == NULL || message->size < 1) ------------------ | Branch (473:9): [True: 0, False: 1.31k] | Branch (473:28): [True: 0, False: 1.31k] ------------------ 474| 0| { 475| 0| if (DEBUG_ACSE) ------------------ | | 32| 0|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 0] | | ------------------ ------------------ 476| 0| printf("ACSE: invalid message - no payload\n"); 477| | 478| 0| return ACSE_ERROR; 479| 0| } 480| | 481| 1.31k| uint8_t* buffer = message->buffer; 482| | 483| 1.31k| int messageSize = message->size; 484| | 485| 1.31k| int bufPos = 0; 486| | 487| 1.31k| uint8_t messageType = buffer[bufPos++]; 488| | 489| 1.31k| int len; 490| | 491| 1.31k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, messageSize); 492| | 493| 1.31k| if (bufPos < 0) ------------------ | Branch (493:9): [True: 217, False: 1.09k] ------------------ 494| 217| { 495| 217| if (DEBUG_ACSE) ------------------ | | 32| 217|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 217] | | ------------------ ------------------ 496| 0| printf("ACSE: AcseConnection_parseMessage: invalid ACSE message!\n"); 497| | 498| 217| return ACSE_ERROR; 499| 217| } 500| | 501| 1.09k| switch (messageType) 502| 1.09k| { 503| 682| case 0x60: ------------------ | Branch (503:5): [True: 682, False: 413] ------------------ 504| 682| indication = parseAarqPdu(self, buffer, bufPos, bufPos + len); 505| 682| break; 506| 403| case 0x61: ------------------ | Branch (506:5): [True: 403, False: 692] ------------------ 507| 403| indication = parseAarePdu(self, buffer, bufPos, bufPos + len); 508| 403| break; 509| 1| case 0x62: /* A_RELEASE.request RLRQ-apdu */ ------------------ | Branch (509:5): [True: 1, False: 1.09k] ------------------ 510| 1| indication = ACSE_RELEASE_REQUEST; 511| 1| break; 512| 2| case 0x63: /* A_RELEASE.response RLRE-apdu */ ------------------ | Branch (512:5): [True: 2, False: 1.09k] ------------------ 513| 2| indication = ACSE_RELEASE_RESPONSE; 514| 2| break; 515| 3| case 0x64: /* A_ABORT */ ------------------ | Branch (515:5): [True: 3, False: 1.09k] ------------------ 516| 3| indication = ACSE_ABORT; 517| 3| break; 518| 1| case 0x00: /* indefinite length end tag -> ignore */ ------------------ | Branch (518:5): [True: 1, False: 1.09k] ------------------ 519| 1| break; 520| 3| default: ------------------ | Branch (520:5): [True: 3, False: 1.09k] ------------------ 521| 3| if (DEBUG_ACSE) ------------------ | | 32| 3|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 3] | | ------------------ ------------------ 522| 0| printf("ACSE: Unknown ACSE message\n"); 523| 3| indication = ACSE_ERROR; 524| 3| break; 525| 1.09k| } 526| | 527| 1.09k| return indication; 528| 1.09k|} acse.c:parseAarqPdu: 283| 682|{ 284| 682| if (DEBUG_ACSE) ------------------ | | 32| 682|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 682] | | ------------------ ------------------ 285| 0| printf("ACSE: parse AARQ PDU\n"); 286| | 287| 682| uint8_t* authValue = NULL; 288| 682| int authValueLen = 0; 289| 682| uint8_t* authMechanism = NULL; 290| 682| int authMechLen = 0; 291| 682| bool userInfoValid = false; 292| | 293| 494k| while (bufPos < maxBufPos) ------------------ | Branch (293:12): [True: 494k, False: 562] ------------------ 294| 494k| { 295| 494k| uint8_t tag = buffer[bufPos++]; 296| 494k| int len; 297| | 298| 494k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 299| | 300| 494k| if (bufPos < 0) ------------------ | Branch (300:13): [True: 74, False: 494k] ------------------ 301| 74| { 302| 74| if (DEBUG_ACSE) ------------------ | | 32| 74|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 74] | | ------------------ ------------------ 303| 0| printf("ACSE: Invalid PDU!\n"); 304| 74| return ACSE_ASSOCIATE_FAILED; 305| 74| } 306| | 307| 494k| if (len == 0) ------------------ | Branch (307:13): [True: 20.0k, False: 474k] ------------------ 308| 20.0k| continue; 309| | 310| 474k| if (bufPos + len > maxBufPos) ------------------ | Branch (310:13): [True: 0, False: 474k] ------------------ 311| 0| { 312| 0| if (DEBUG_ACSE) ------------------ | | 32| 0|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 0] | | ------------------ ------------------ 313| 0| printf("ACSE: Invalid PDU!\n"); 314| 0| return ACSE_ASSOCIATE_FAILED; 315| 0| } 316| | 317| 474k| switch (tag) 318| 474k| { 319| 1| case 0xa1: /* application context name */ ------------------ | Branch (319:9): [True: 1, False: 474k] ------------------ 320| 1| bufPos += len; 321| 1| break; 322| | 323| 407| case 0xa2: /* called AP title */ ------------------ | Branch (323:9): [True: 407, False: 473k] ------------------ 324| 407| bufPos += len; 325| 407| break; 326| 0| case 0xa3: /* called AE qualifier */ ------------------ | Branch (326:9): [True: 0, False: 474k] ------------------ 327| 0| bufPos += len; 328| 0| break; 329| | 330| 35.6k| case 0xa6: /* calling AP title */ ------------------ | Branch (330:9): [True: 35.6k, False: 438k] ------------------ 331| 35.6k| { 332| 35.6k| if (len >= 2 && buffer[bufPos] == 0x06) ------------------ | Branch (332:21): [True: 30.2k, False: 5.38k] | Branch (332:33): [True: 28.5k, False: 1.69k] ------------------ 333| 28.5k| { 334| | /* ap-title-form2 */ 335| | 336| 28.5k| int innerLength = buffer[bufPos + 1]; 337| | 338| 28.5k| if ((innerLength >= 0) && (innerLength == len - 2)) ------------------ | Branch (338:25): [True: 28.5k, False: 0] | Branch (338:47): [True: 27.8k, False: 656] ------------------ 339| 27.8k| BerDecoder_decodeOID(buffer, bufPos + 2, innerLength, &(self->applicationReference.apTitle)); 340| 28.5k| } 341| 35.6k| } 342| 35.6k| bufPos += len; 343| 35.6k| break; 344| | 345| 32.6k| case 0xa7: /* calling AE qualifier */ ------------------ | Branch (345:9): [True: 32.6k, False: 441k] ------------------ 346| 32.6k| { 347| 32.6k| if (len >= 2 && buffer[bufPos] == 0x02) ------------------ | Branch (347:21): [True: 32.2k, False: 497] | Branch (347:33): [True: 28.1k, False: 4.08k] ------------------ 348| 28.1k| { 349| | /* ae-qualifier-form2 */ 350| | 351| 28.1k| int innerLength = buffer[bufPos + 1]; 352| | 353| 28.1k| if ((innerLength >= 0) && (innerLength == len - 2)) ------------------ | Branch (353:25): [True: 28.1k, False: 0] | Branch (353:47): [True: 24.1k, False: 3.98k] ------------------ 354| 24.1k| self->applicationReference.aeQualifier = BerDecoder_decodeInt32(buffer, innerLength, bufPos + 2); 355| 28.1k| } 356| 32.6k| } 357| 32.6k| bufPos += len; 358| 32.6k| break; 359| | 360| 0| case 0x8a: /* sender ACSE requirements */ ------------------ | Branch (360:9): [True: 0, False: 474k] ------------------ 361| 0| bufPos += len; 362| 0| break; 363| | 364| 398| case 0x8b: /* (authentication) mechanism name */ ------------------ | Branch (364:9): [True: 398, False: 473k] ------------------ 365| 398| authMechLen = len; 366| 398| authMechanism = buffer + bufPos; 367| 398| bufPos += len; 368| 398| break; 369| | 370| 659| case 0xac: /* authentication value */ ------------------ | Branch (370:9): [True: 659, False: 473k] ------------------ 371| 659| bufPos++; 372| | 373| 659| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 374| 659| if (bufPos < 0) ------------------ | Branch (374:17): [True: 1, False: 658] ------------------ 375| 1| { 376| 1| if (DEBUG_ACSE) ------------------ | | 32| 1|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 1] | | ------------------ ------------------ 377| 0| printf("ACSE: Invalid PDU!\n"); 378| 1| return ACSE_ASSOCIATE_FAILED; 379| 1| } 380| | 381| 658| authValueLen = len; 382| 658| authValue = buffer + bufPos; 383| 658| bufPos += len; 384| 658| break; 385| | 386| 7.74k| case 0xbe: /* user information */ ------------------ | Branch (386:9): [True: 7.74k, False: 466k] ------------------ 387| 7.74k| if (buffer[bufPos] != 0x28) ------------------ | Branch (387:17): [True: 2.05k, False: 5.69k] ------------------ 388| 2.05k| { 389| 2.05k| if (DEBUG_ACSE) ------------------ | | 32| 2.05k|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 2.05k] | | ------------------ ------------------ 390| 0| printf("ACSE: invalid user info\n"); 391| 2.05k| bufPos += len; 392| 2.05k| } 393| 5.69k| else 394| 5.69k| { 395| 5.69k| bufPos++; 396| | 397| 5.69k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 398| | 399| 5.69k| if (bufPos < 0) ------------------ | Branch (399:21): [True: 4, False: 5.69k] ------------------ 400| 4| { 401| 4| if (DEBUG_ACSE) ------------------ | | 32| 4|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 4] | | ------------------ ------------------ 402| 0| printf("ACSE: Invalid PDU!\n"); 403| 4| return ACSE_ASSOCIATE_FAILED; 404| 4| } 405| | 406| 5.69k| bufPos = parseUserInformation(self, buffer, bufPos, bufPos + len, &userInfoValid); 407| | 408| 5.69k| if (bufPos < 0) ------------------ | Branch (408:21): [True: 41, False: 5.65k] ------------------ 409| 41| { 410| 41| if (DEBUG_ACSE) ------------------ | | 32| 41|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 41] | | ------------------ ------------------ 411| 0| printf("ACSE: Invalid PDU!\n"); 412| 41| return ACSE_ASSOCIATE_FAILED; 413| 41| } 414| 5.69k| } 415| 7.70k| break; 416| | 417| 7.70k| case 0x00: /* indefinite length end tag -> ignore */ ------------------ | Branch (417:9): [True: 5.21k, False: 468k] ------------------ 418| 5.21k| break; 419| | 420| 391k| default: /* ignore unknown tag */ ------------------ | Branch (420:9): [True: 391k, False: 82.7k] ------------------ 421| 391k| if (DEBUG_ACSE) ------------------ | | 32| 391k|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 391k] | | ------------------ ------------------ 422| 0| printf("ACSE: parseAarqPdu: unknown tag %02x\n", tag); 423| | 424| 391k| bufPos += len; 425| 391k| break; 426| 474k| } 427| 474k| } 428| | 429| 562| if (checkAuthentication(self, authMechanism, authMechLen, authValue, authValueLen) == false) ------------------ | Branch (429:9): [True: 0, False: 562] ------------------ 430| 0| { 431| 0| if (DEBUG_ACSE) ------------------ | | 32| 0|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 0] | | ------------------ ------------------ 432| 0| printf("ACSE: parseAarqPdu: check authentication failed!\n"); 433| | 434| 0| return ACSE_ASSOCIATE_FAILED; 435| 0| } 436| | 437| 562| if (userInfoValid == false) ------------------ | Branch (437:9): [True: 551, False: 11] ------------------ 438| 551| { 439| 551| if (DEBUG_ACSE) ------------------ | | 32| 551|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 551] | | ------------------ ------------------ 440| 0| printf("ACSE: parseAarqPdu: user info invalid!\n"); 441| | 442| 551| return ACSE_ASSOCIATE_FAILED; 443| 551| } 444| | 445| 11| return ACSE_ASSOCIATE; 446| 562|} acse.c:parseUserInformation: 119| 10.0k|{ 120| 10.0k| if (DEBUG_ACSE) ------------------ | | 32| 10.0k|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 10.0k] | | ------------------ ------------------ 121| 0| printf("ACSE: parseUserInformation %i %i\n", bufPos, maxBufPos); 122| | 123| 10.0k| bool hasindirectReference = false; 124| 10.0k| bool isDataValid = false; 125| | 126| 210k| while (bufPos < maxBufPos) ------------------ | Branch (126:12): [True: 200k, False: 9.98k] ------------------ 127| 200k| { 128| 200k| uint8_t tag = buffer[bufPos++]; 129| 200k| int len; 130| | 131| 200k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 132| | 133| 200k| if ((bufPos < 0) || (bufPos + len > maxBufPos)) ------------------ | Branch (133:13): [True: 87, False: 200k] | Branch (133:29): [True: 0, False: 200k] ------------------ 134| 87| { 135| 87| *userInfoValid = false; 136| 87| return -1; 137| 87| } 138| | 139| 200k| if (len == 0) ------------------ | Branch (139:13): [True: 21.2k, False: 179k] ------------------ 140| 21.2k| continue; 141| | 142| 179k| switch (tag) 143| 179k| { 144| | 145| 123k| case 0x02: /* indirect-reference */ ------------------ | Branch (145:9): [True: 123k, False: 56.2k] ------------------ 146| 123k| self->nextReference = BerDecoder_decodeUint32(buffer, len, bufPos); 147| 123k| bufPos += len; 148| 123k| hasindirectReference = true; 149| 123k| break; 150| | 151| 2.78k| case 0xa0: /* encoding */ ------------------ | Branch (151:9): [True: 2.78k, False: 176k] ------------------ 152| 2.78k| isDataValid = true; 153| | 154| 2.78k| self->userDataBufferSize = len; 155| 2.78k| self->userDataBuffer = buffer + bufPos; 156| | 157| 2.78k| bufPos += len; 158| | 159| 2.78k| break; 160| | 161| 53.4k| default: /* ignore unknown tag */ ------------------ | Branch (161:9): [True: 53.4k, False: 125k] ------------------ 162| 53.4k| bufPos += len; 163| 179k| } 164| 179k| } 165| | 166| 9.98k| if (DEBUG_ACSE) ------------------ | | 32| 9.98k|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 9.98k] | | ------------------ ------------------ 167| 0| { 168| 0| if (!hasindirectReference) ------------------ | Branch (168:13): [True: 0, False: 0] ------------------ 169| 0| printf("ACSE: User data has no indirect reference!\n"); 170| | 171| 0| if (!isDataValid) ------------------ | Branch (171:13): [True: 0, False: 0] ------------------ 172| 0| printf("ACSE: No valid user data\n"); 173| 0| } 174| | 175| 9.98k| if (hasindirectReference && isDataValid) ------------------ | Branch (175:9): [True: 5.83k, False: 4.14k] | Branch (175:33): [True: 627, False: 5.21k] ------------------ 176| 627| *userInfoValid = true; 177| 9.35k| else 178| 9.35k| *userInfoValid = false; 179| | 180| 9.98k| return bufPos; 181| 10.0k|} acse.c:checkAuthentication: 84| 562|{ 85| 562| self->securityToken = NULL; 86| | 87| 562| if (self->authenticator != NULL) ------------------ | Branch (87:9): [True: 0, False: 562] ------------------ 88| 0| { 89| 0| AcseAuthenticationMechanism mechanism = checkAuthMechanismName(authMechanism, authMechLen); 90| | 91| 0| if (mechanism == ACSE_AUTH_NONE) ------------------ | Branch (91:13): [True: 0, False: 0] ------------------ 92| 0| { 93| |#if (CONFIG_MMS_SUPPORT_TLS == 1) 94| | if (self->tlsSocket) 95| | { 96| | int certLen; 97| | 98| | uint8_t* certBuf = TLSSocket_getPeerCertificate(self->tlsSocket, &certLen); 99| | 100| | if (certBuf) { 101| | mechanism = ACSE_AUTH_TLS; 102| | authValue = certBuf; 103| | authValueLen = certLen; 104| | } 105| | 106| | } 107| |#endif /* (CONFIG_MMS_SUPPORT_TLS == 1) */ 108| | 109| 0| } 110| | 111| 0| return authenticateClient(self, mechanism, authValue, authValueLen); 112| 0| } 113| 562| else 114| 562| return true; 115| 562|} acse.c:parseAarePdu: 185| 403|{ 186| 403| if (DEBUG_ACSE) ------------------ | | 32| 403|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 403] | | ------------------ ------------------ 187| 0| printf("ACSE: parse AARE PDU\n"); 188| | 189| 403| bool userInfoValid = false; 190| | 191| 403| uint32_t result = 99; 192| | 193| 588k| while (bufPos < maxBufPos) ------------------ | Branch (193:12): [True: 588k, False: 297] ------------------ 194| 588k| { 195| 588k| uint8_t tag = buffer[bufPos++]; 196| 588k| int len; 197| | 198| 588k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 199| | 200| 588k| if (bufPos < 0) ------------------ | Branch (200:13): [True: 55, False: 588k] ------------------ 201| 55| { 202| 55| if (DEBUG_ACSE) ------------------ | | 32| 55|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 55] | | ------------------ ------------------ 203| 0| printf("ACSE: Invalid PDU!\n"); 204| 55| return ACSE_ERROR; 205| 55| } 206| | 207| 588k| if (len == 0) ------------------ | Branch (207:13): [True: 17.9k, False: 570k] ------------------ 208| 17.9k| continue; 209| | 210| 570k| if (bufPos + len > maxBufPos) ------------------ | Branch (210:13): [True: 0, False: 570k] ------------------ 211| 0| { 212| 0| if (DEBUG_ACSE) ------------------ | | 32| 0|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 0] | | ------------------ ------------------ 213| 0| printf("ACSE: Invalid PDU!\n"); 214| 0| return ACSE_ERROR; 215| 0| } 216| | 217| 570k| switch (tag) 218| 570k| { 219| 12| case 0xa1: /* application context name */ ------------------ | Branch (219:9): [True: 12, False: 570k] ------------------ 220| 12| bufPos += len; 221| 12| break; 222| | 223| 3.19k| case 0xa2: /* result */ ------------------ | Branch (223:9): [True: 3.19k, False: 566k] ------------------ 224| 3.19k| bufPos++; 225| | 226| 3.19k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 227| 3.19k| if (bufPos < 0) ------------------ | Branch (227:17): [True: 2, False: 3.19k] ------------------ 228| 2| return ACSE_ERROR; 229| | 230| 3.19k| result = BerDecoder_decodeUint32(buffer, len, bufPos); 231| | 232| 3.19k| bufPos += len; 233| 3.19k| break; 234| | 235| 0| case 0xa3: /* result source diagnostic */ ------------------ | Branch (235:9): [True: 0, False: 570k] ------------------ 236| 0| bufPos += len; 237| 0| break; 238| | 239| 5.08k| case 0xbe: /* user information */ ------------------ | Branch (239:9): [True: 5.08k, False: 565k] ------------------ 240| 5.08k| if (buffer[bufPos] != 0x28) ------------------ | Branch (240:17): [True: 702, False: 4.38k] ------------------ 241| 702| { 242| 702| if (DEBUG_ACSE) ------------------ | | 32| 702|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 702] | | ------------------ ------------------ 243| 0| printf("ACSE: invalid user info\n"); 244| 702| bufPos += len; 245| 702| } 246| 4.38k| else 247| 4.38k| { 248| 4.38k| bufPos++; 249| | 250| 4.38k| bufPos = BerDecoder_decodeLength(buffer, &len, bufPos, maxBufPos); 251| 4.38k| if (bufPos < 0) ------------------ | Branch (251:21): [True: 3, False: 4.37k] ------------------ 252| 3| return ACSE_ERROR; 253| | 254| 4.37k| bufPos = parseUserInformation(self, buffer, bufPos, bufPos + len, &userInfoValid); 255| 4.37k| if (bufPos < 0) ------------------ | Branch (255:21): [True: 46, False: 4.33k] ------------------ 256| 46| return ACSE_ERROR; 257| 4.37k| } 258| 5.03k| break; 259| | 260| 5.07k| case 0x00: /* indefinite length end tag -> ignore */ ------------------ | Branch (260:9): [True: 5.07k, False: 565k] ------------------ 261| 5.07k| break; 262| | 263| 556k| default: /* ignore unknown tag */ ------------------ | Branch (263:9): [True: 556k, False: 13.3k] ------------------ 264| 556k| if (DEBUG_ACSE) ------------------ | | 32| 556k|#define DEBUG_ACSE 0 | | ------------------ | | | Branch (32:20): [Folded, False: 556k] | | ------------------ ------------------ 265| 0| printf("ACSE: parseAarePdu: unknown tag %02x\n", tag); 266| | 267| 556k| bufPos += len; 268| 556k| break; 269| 570k| } 270| 570k| } 271| | 272| 297| if (!userInfoValid) ------------------ | Branch (272:9): [True: 277, False: 20] ------------------ 273| 277| return ACSE_ERROR; 274| | 275| 20| if (result != 0) ------------------ | Branch (275:9): [True: 17, False: 3] ------------------ 276| 17| return ACSE_ASSOCIATE_FAILED; 277| | 278| 3| return ACSE_ASSOCIATE; 279| 20|}