(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-vnc.c) |
| |
| 1804 | | | vnc_zrle_encoding(tvbuff_t *tvb, packet_info *pinfo, gint *offset, |
| 1805 | | | proto_tree *tree, guint16 width, guint16 height) |
| 1806 | | | #else |
| 1807 | | | static guint |
| 1808 | | | vnc_zrle_encoding(tvbuff_t *tvb, packet_info *pinfo _U_, gint *offset, |
| 1809 | | | proto_tree *tree, guint16 width _U_, guint16 height _U_) |
| 1810 | | | #endif |
| 1811 | | | { |
| 1812 | | | guint32 data_len; |
| 1813 | | | #ifdef HAVE_LIBZ |
| 1814 | | | guint8 palette_size; |
| 1815 | | | guint8 bytes_per_cpixel = vnc_get_bytes_per_pixel(pinfo); |
| 1816 | | | gint uncomp_offset = 0; |
| 1817 | | | guint length; |
| 1818 | | | gint subencoding_type; |
| 1819 | | | tvbuff_t *uncomp_tvb = NULL; |
| 1820 | | | proto_tree *zrle_subencoding_tree; |
| 1821 | | | proto_item *ti; |
| 1822 | | | #endif |
| 1823 | | | |
| 1824 | [+] | | VNC_BYTES_NEEDED(4);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-vnc.c |
| |
295 | #define VNC_BYTES_NEEDED(a) \ |
296 | if(a > (guint)tvb_length_remaining(tvb, *offset)) \ |
297 | return a; |
| |
|
 |
| 1825 | | | proto_tree_add_item(tree, hf_vnc_zrle_len, tvb, *offset, |
| 1826 | | | 4, FALSE); |
| 1827 | [+] | | data_len = tvb_get_ntohl(tvb, *offset); |
 |
| 1828 | | | |
| 1829 | | | *offset += 4; |
| 1830 | | | |
| 1831 | | | VNC_BYTES_NEEDED(data_len);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-vnc.c |
| |
295 | #define VNC_BYTES_NEEDED(a) \ |
296 | if(a > (guint)tvb_length_remaining(tvb, *offset)) \ |
297 | return a; |
| |
|
Event 13:
Skipping " if". data_len > (guint)tvb_length_remaining(...) evaluates to false.
hide
|
|
| 1832 | | | |
| 1833 | | | proto_tree_add_item(tree, hf_vnc_zrle_data, tvb, *offset, |
| 1834 | | | data_len, FALSE); |
| 1835 | | | |
| 1836 | | | #ifdef HAVE_LIBZ |
| 1837 | [+] | | uncomp_tvb = tvb_child_uncompress(tvb, tvb, *offset, data_len); |
 |
| 1838 | | | |
| 1839 | | | if(uncomp_tvb != NULL) { |
Event 34:
Taking true branch. uncomp_tvb != (void *)0 evaluates to true.
hide
|
|
| 1840 | | | add_new_data_source(pinfo, uncomp_tvb, |
| 1841 | | | "Uncompressed ZRLE data"); |
| 1842 | | | |
| 1843 | | | ti = proto_tree_add_item(tree, hf_vnc_zrle_subencoding, |
| 1844 | | | uncomp_tvb, uncomp_offset, 1, FALSE); |
| 1845 | | | zrle_subencoding_tree = |
| 1846 | | | proto_item_add_subtree(ti, ett_vnc_zrle_subencoding); |
| 1847 | | | |
| 1848 | | | proto_tree_add_item(zrle_subencoding_tree, hf_vnc_zrle_rle, |
| 1849 | | | uncomp_tvb, uncomp_offset, 1, FALSE); |
| 1850 | | | |
| 1851 | | | proto_tree_add_item(zrle_subencoding_tree, |
| 1852 | | | hf_vnc_zrle_palette_size, uncomp_tvb, |
| 1853 | [+] | | uncomp_offset, 1, FALSE); |
 |
| 1854 | | | |
| 1855 | [+] | | subencoding_type = tvb_get_guint8(uncomp_tvb, uncomp_offset); |
 |
| 1856 | | | palette_size = subencoding_type & 0x7F; |
| 1857 | | | |
| 1858 | | | uncomp_offset += 1; |
| 1859 | | | |
| 1860 | | | if(subencoding_type == 0) { |
Event 44:
Taking true branch. subencoding_type == 0 evaluates to true.
hide
|
|
| 1861 | | | length = width * height * bytes_per_cpixel; |
| 1862 | [+] | | VNC_BYTES_NEEDED(length);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-vnc.c |
| |
295 | #define VNC_BYTES_NEEDED(a) \ |
296 | if(a > (guint)tvb_length_remaining(tvb, *offset)) \ |
297 | return a; |
| |
|
 |
| |