(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-homeplug.c) |
| |
| 1324 | | | dissect_homeplug(tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree) |
| 1325 | | | { |
| 1326 | | | proto_item * it= NULL; |
| 1327 | | | proto_tree * homeplug_tree= NULL; |
| 1328 | | | ptvcursor_t * cursor= NULL; |
Event 1:
cursor is set to NULL. - Dereferenced later, causing the null pointer dereference.
hide
|
|
| 1329 | | | |
| 1330 | [+] | | if (check_col(pinfo->cinfo, COL_PROTOCOL)) |
 |
| 1331 | | | col_set_str(pinfo->cinfo, COL_PROTOCOL, "HomePlug"); |
| 1332 | | | |
| 1333 | [+] | | if (check_col(pinfo->cinfo, COL_INFO)) { |
 |
| 1334 | | | col_clear(pinfo->cinfo, COL_INFO); |
| 1335 | | | col_set_str(pinfo->cinfo, COL_INFO, "MAC Management"); |
| 1336 | | | } |
| 1337 | | | |
| 1338 | | | homeplug_offset = 0; |
| 1339 | | | |
| 1340 | | | if (tree) { |
Event 6:
Skipping " if". tree evaluates to false.
hide
|
|
| 1341 | | | it = proto_tree_add_item(tree, proto_homeplug, tvb, homeplug_offset, -1, FALSE); |
| 1342 | | | homeplug_tree = proto_item_add_subtree(it, ett_homeplug); |
| 1343 | | | cursor = ptvcursor_new(homeplug_tree, tvb, 0); |
| 1344 | | | } |
| 1345 | | | |
| 1346 | | | |
| 1347 | [+] | | if (check_tvb_length(cursor, HOMEPLUG_MCTRL_LEN) != TVB_LEN_SHORTEST) { |
 |
| 1348 | | | |
| 1349 | | | dissect_homeplug_mctrl(cursor); |
| 1350 | | | |
| 1351 | | | |
| 1352 | | | |
| 1353 | | | |
| 1354 | [+] | | if ((homeplug_ne > 0) && check_col(pinfo->cinfo, COL_INFO)) { |
Event 9:
Skipping " if". homeplug_ne > 0 evaluates to true.
hide
|
|
 |
| 1355 | | | col_clear(pinfo->cinfo, COL_INFO); |
| 1356 | | | } |
| 1357 | | | for (; homeplug_ne > 0; homeplug_ne--) { |
Event 12:
Entering loop body. homeplug_ne > 0 evaluates to true.
hide
|
|
| 1358 | | | |
| 1359 | | | |
| 1360 | [+] | | if (check_tvb_length(cursor, HOMEPLUG_MEHDR_LEN) == TVB_LEN_SHORTEST) |
 |
| 1361 | | | break; |
| 1362 | | | dissect_homeplug_mehdr(cursor); |
| 1363 | | | |
| 1364 | | | |
| 1365 | [+] | | if (check_tvb_length(cursor, HOMEPLUG_MELEN_LEN) == TVB_LEN_SHORTEST) |
 |
| 1366 | | | break; |
| 1367 | | | dissect_homeplug_melen(cursor); |
| 1368 | | | |
| 1369 | [+] | | dissect_homeplug_mme(cursor, pinfo); |
Event 17:
cursor, which evaluates to NULL, is passed to dissect_homeplug_mme() as the first argument. See related event 1.
hide
|
|
 |
| |