ms_nrtp: bound NRBF string lengths to 31 bits

scapy/layers/ms_nrtp.py

@@ -17,6 +17,7 @@
 
 from scapy.automaton import Automaton, ATMT
 from scapy.config import conf
+from scapy.error import Scapy_Exception
 from scapy.main import interact
 from scapy.fields import (
     ByteEnumField,
@@ -337,6 +338,11 @@ def __init__(self, name, default, length_of=None):
         FieldLenField.__init__(self, name, default, length_of=length_of)
         super(MSBExtendedFieldLen, self).__init__(name, default)
 
+    def getfield(self, pkt, s):
+        if len(s) >= 5 and min(s[:4]) >= 0x80 and s[4] > 0x07:
+            raise Scapy_Exception("NRBF string length exceeds 31 bits")
+        return super(MSBExtendedFieldLen, self).getfield(pkt, s)
+
     i2m = FieldLenField.i2m
 
 

test/scapy/layers/msnrtp.uts

@@ -39,6 +39,17 @@ assert pkt.records[3].Values == b"TRIMMED"
 
 assert isinstance(pkt.records[4], NRBFMessageEnd)
 
+= [MS-NRBF] reject a string length wider than 31 bits
+
+# The over-wide length is meant to be rejected and fall back to Raw, so the
+# debug dissector must not turn that rejection into a raised exception.
+with no_debug_dissector():
+    pkt = NRBF(b"\x0c\x01\x00\x00\x00" + b"\x81" * 5)
+    assert isinstance(pkt.records[0], Raw)
+
+maximum = NRBFLengthPrefixedString(b"\xff\xff\xff\xff\x07")
+assert maximum.Length == 0x7fffffff
+
 = [MS-NRBF] build .NET Binary Format
 
 pkt = NRBF(