(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-rtp.c) |
| |
| 907 | | | dissect_rtp_rfc2198(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree ) |
| 908 | | | { |
| 909 | | | int offset = 0; |
| 910 | | | guint8 octet1; |
| 911 | | | int cnt; |
| 912 | | | gboolean hdr_follow = TRUE; |
Event 1:
!0 evaluates to true.
hide
|
|
| 913 | | | proto_item *ti = NULL; |
| 914 | | | proto_tree *rfc2198_tree = NULL; |
| 915 | | | proto_tree *rfc2198_hdr_tree = NULL; |
| 916 | | | rfc2198_hdr *hdr_last, *hdr_new; |
| 917 | | | rfc2198_hdr *hdr_chain = NULL; |
| 918 | | | struct _rtp_conversation_info *p_conv_data= NULL; |
| 919 | | | gchar *payload_type_str; |
| 920 | | | |
| 921 | | | |
| 922 | | | p_conv_data = p_get_proto_data(pinfo->fd, proto_rtp); |
| 923 | | | |
| 924 | | | |
| 925 | | | ti = proto_tree_add_text(tree, tvb, offset, -1, "RFC 2198: Redundant Audio Data"); |
| 926 | | | rfc2198_tree = proto_item_add_subtree(ti, ett_rtp_rfc2198); |
| 927 | | | |
| 928 | | | hdr_last = NULL; |
| 929 | | | cnt = 0; |
| 930 | | | while (hdr_follow) { |
Event 3:
During loop iterations, hdr_last is dereferenced.
hide
Event 4:
Continuing from loop body. Entering loop body. hdr_follow evaluates to true.
hide
|
|
| 931 | | | cnt++; |
| 932 | | | payload_type_str = NULL; |
| 933 | | | |
| 934 | | | |
| 935 | | | hdr_new = ep_alloc(sizeof(rfc2198_hdr)); |
| 936 | | | hdr_new->next = NULL; |
| 937 | | | octet1 = tvb_get_guint8(tvb, offset); |
| 938 | | | hdr_new->pt = RTP_PAYLOAD_TYPE(octet1); |
| 939 | | | hdr_follow = (octet1 & 0x80); |
| 940 | | | |
| 941 | | | |
| 942 | | | if ((hdr_new->pt > 95) && (hdr_new->pt < 128)) { |
| 943 | | | if (p_conv_data && p_conv_data->rtp_dyn_payload){ |
| 944 | | | payload_type_str = g_hash_table_lookup(p_conv_data->rtp_dyn_payload, &hdr_new->pt); |
| 945 | | | } |
| 946 | | | } |
| 947 | | | |
| 948 | | | ti = proto_tree_add_text(rfc2198_tree, tvb, offset, (hdr_follow)?4:1, " %u", cnt); |
Event 8:
hdr_follow evaluates to false.
hide
|
|
| 949 | | | rfc2198_hdr_tree = proto_item_add_subtree(ti, ett_rtp_rfc2198_hdr); |
| 950 | | | proto_tree_add_item(rfc2198_hdr_tree, hf_rtp_rfc2198_follow, tvb, offset, 1, FALSE ); |
| 951 | | | proto_tree_add_uint_format(rfc2198_hdr_tree, hf_rtp_payload_type, tvb, |
| 952 | | | offset, 1, octet1, "Payload type: %s (%u)", |
| 953 | | | payload_type_str ? payload_type_str : val_to_str(hdr_new->pt, rtp_payload_type_vals, "Unknown"), |
Event 9:
payload_type_str evaluates to true.
hide
|
|
| 954 | | | hdr_new->pt); |
| 955 | | | proto_item_append_text(ti, ": PT=%s", |
| 956 | | | payload_type_str ? payload_type_str : |
Event 10:
payload_type_str evaluates to true.
hide
|
|
| 957 | | | val_to_str(hdr_new->pt, rtp_payload_type_vals, "Unknown (%u)")); |
| 958 | | | offset += 1; |
| 959 | | | |
| 960 | | | |
| 961 | | | if (hdr_follow) { |
Event 11:
Taking false branch. hdr_follow evaluates to false.
hide
|
|
| 962 | | | proto_tree_add_item(rfc2198_hdr_tree, hf_rtp_rfc2198_tm_off, tvb, offset, 2, FALSE ); |
| 963 | | | proto_tree_add_item(rfc2198_hdr_tree, hf_rtp_rfc2198_bl_len, tvb, offset + 1, 2, FALSE ); |
| 964 | | | hdr_new->len = tvb_get_ntohs(tvb, offset + 1) & 0x03FF; |
| 965 | | | proto_item_append_text(ti, ", len=%u", hdr_new->len); |
| 966 | | | offset += 3; |
| 967 | | | } else { |
| 968 | | | hdr_new->len = -1; |
| 969 | | | hdr_follow = FALSE; |
| 970 | | | } |
| 971 | | | |
| 972 | | | if (hdr_last) { |
Null Test After Dereference
This code tests the nullness of hdr_last, which has already been dereferenced. - If hdr_last were null, there would have been a prior null pointer dereference at packet-rtp.c:930, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 3. Show: All events | Only primary events |
|
| 973 | | | hdr_last->next = hdr_new; |
| 974 | | | } else { |
| 975 | | | hdr_chain = hdr_new; |
| 976 | | | } |
| 977 | | | hdr_last = hdr_new; |
| 978 | | | } |
| 979 | | | |
| 980 | | | |
| 981 | | | hdr_last = hdr_chain; |
| 982 | | | while (hdr_last) { |
| 983 | | | hdr_last->offset = offset; |
| 984 | | | if (!hdr_last->next) { |
| 985 | | | hdr_last->len = tvb_reported_length_remaining(tvb, offset); |
| 986 | | | } |
| 987 | | | dissect_rtp_data(tvb, pinfo, tree, rfc2198_tree, hdr_last->offset, hdr_last->len, hdr_last->len, hdr_last->pt); |
| 988 | | | offset += hdr_last->len; |
| 989 | | | hdr_last = hdr_last->next; |
| 990 | | | } |
| 991 | | | } |
| |