Malformed S1AP NAS-PDU

edit

Hi Pascal - thank you,

the MS Classmark 3 as having a length too short

Not sure if I got the idea right but looks like manually changing its current length 03 to 0A makes the whole message decode correctly, so I'm wondering if that 40 05 70 40 26 00 00 is Supported Codecs IE indeed or rather it's just part of MS Classmark 3.. https://drive.google.com/file/d/1jYGR...

Please let me know if you want me to file a bug/enhacement on it anyway.

Thanks & Regards,

Dmitriy

Manually modifying the IE length allows you to hide the problem, but still the MS Classmark 3 content is suspicious (spare bit set to 1, A5/7 algorithm supported while it does not exist), so I doubt it is valid.

Anyway I added an extra check in this commit: https://code.wireshark.org/review/#/c...

It will trigger another malformed error but with a more meaningful message.

Thank you: I'm checking NAS-EPS PDU encoding with our Engineering team in parallel.

Hi Pascal, sorry could you please explain why exactly Wireshark used to consider my MS Classmark 3 "as having a length too short compared to the payload parsing"? After Item 1 ID code 0x26 (id-NAS-PDU) and 0x00 (criticality=reject) goes 0x37, which looks like a valid length of the remainder as it covers it exactly incl Supported Codecs IE. Meanwhile MS Classmark 3 IE itself has allowed length 0x03 (which can be 1-32 octets as per 3gpp 48.008), same as MS Classmark 2 IE. So I'm struggling to understand why Wireshark used to consider Supported Codecs IE as the continuation of MS Classmark 3 before the changes you've made. Meanwhile how can I obtain the build with the changes? Thanks in advance, Dmitriy

You need to check the MS Classmark 3 encoding in 3GPP 24.008 spec and do the decoding manually. You will see that the parsing of the bits goes beyond the 3 bytes indicated in the IE, which is an encoding error. You an find builds with my change here: https://www.wireshark.org/download/au... But again it simply gives a better error message, it does not solve anything as the message is not properly encoded.