(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-aim.c) |
| |
| 779 | | | static void dissect_aim_snac(tvbuff_t *tvb, packet_info *pinfo, |
| 780 | | | int offset, proto_tree *aim_tree, proto_tree *root_tree) |
| 781 | | | { |
| 782 | | | guint16 family_id; |
| 783 | | | guint16 subtype_id; |
| 784 | | | guint16 flags; |
| 785 | | | guint32 id; |
| 786 | | | proto_item *ti1; |
| 787 | | | struct aiminfo aiminfo; |
| 788 | | | proto_tree *aim_tree_fnac = NULL; |
| 789 | | | tvbuff_t *subtvb; |
| 790 | | | int orig_offset; |
| 791 | | | const aim_subtype *subtype; |
| 792 | | | proto_tree *family_tree = NULL; |
| 793 | | | const aim_family *family; |
| 794 | | | void* pd_save; |
| 795 | | | |
| 796 | | | orig_offset = offset; |
| 797 | | | family_id = tvb_get_ntohs(tvb, offset); |
| 798 | | | family = aim_get_family(family_id); |
| 799 | | | offset += 2; |
| 800 | | | subtype_id = tvb_get_ntohs(tvb, offset); |
| 801 | | | subtype = aim_get_subtype(family_id, subtype_id); |
| 802 | | | offset += 2; |
| 803 | | | flags = tvb_get_ntohs(tvb, offset); |
| 804 | | | offset += 2; |
| 805 | | | id = tvb_get_ntohl(tvb, offset); |
| 806 | | | offset += 4; |
| 807 | | | |
| 808 | | | |
| 809 | | | if( aim_tree ) |
Event 1:
Taking true branch. aim_tree evaluates to true.
hide
|
|
| 810 | | | { |
| 811 | | | offset = orig_offset; |
| 812 | | | ti1 = proto_tree_add_text(aim_tree, tvb, 6, 10, "FNAC: Family: %s (0x%04x), Subtype: %s (0x%04x)", |
| 813 | | | family?family->name:"Unknown", family_id, |
Event 3:
family evaluates to true.
hide
|
|
| 814 | | | (subtype && subtype->name)?subtype->name:"Unknown", subtype_id); |
Event 2:
subtype evaluates to false.
hide
|
|
| 815 | | | aim_tree_fnac = proto_item_add_subtree(ti1, ett_aim_fnac); |
| 816 | | | |
| 817 | | | proto_tree_add_text (aim_tree_fnac, |
| 818 | | | tvb, offset, 2, "Family: %s (0x%04x)", family?family->name:"Unknown", family_id); |
Event 4:
family evaluates to true.
hide
|
|
| 819 | | | offset += 2; |
| 820 | | | |
| 821 | | | proto_tree_add_text (aim_tree_fnac, |
| 822 | | | tvb, offset, 2, "Subtype: %s (0x%04x)", (subtype && subtype->name)?subtype->name:"Unknown", subtype_id); |
Event 6:
subtype evaluates to false.
hide
|
|
| 823 | | | offset += 2; |
| 824 | | | |
| 825 | | | ti1 = proto_tree_add_uint(aim_tree_fnac, hf_aim_fnac_flags, tvb, offset, |
| 826 | | | 2, flags); |
| 827 | | | |
| 828 | | | offset = dissect_aim_fnac_flags(tvb, offset, 2, ti1, flags); |
| 829 | | | |
| 830 | | | proto_tree_add_uint(aim_tree_fnac, hf_aim_fnac_id, tvb, offset, |
| 831 | | | 4, id); |
| 832 | | | offset += 4; |
| 833 | | | } |
| 834 | | | |
| 835 | | | if(flags & FNAC_FLAG_CONTAINS_VERSION) { |
Event 7:
Skipping " if". flags & 32768 evaluates to false.
hide
|
|
| 836 | | | guint16 len = tvb_get_ntohs(tvb, offset); |
| 837 | | | int oldoffset; |
| 838 | | | offset+=2; |
| 839 | | | oldoffset = offset; |
| 840 | | | |
| 841 | | | while(offset < oldoffset + len) { |
| 842 | | | offset = dissect_aim_tlv(tvb, pinfo, offset, aim_tree, fnac_tlvs); |
| 843 | | | } |
| 844 | | | } |
| 845 | | | |
| 846 | | | subtvb = tvb_new_subset(tvb, offset, -1, -1); |
| 847 | | | aiminfo.tcpinfo = pinfo->private_data; |
| 848 | | | aiminfo.family = family_id; |
| 849 | | | aiminfo.subtype = subtype_id; |
| 850 | | | pd_save = pinfo->private_data; |
| 851 | | | pinfo->private_data = &aiminfo; |
| 852 | | | |
| 853 | | | if (check_col(pinfo->cinfo, COL_PROTOCOL) && family) { |
Event 8:
Skipping " if". check_col(...) evaluates to false.
hide
|
|
| 854 | | | col_set_str(pinfo->cinfo, COL_PROTOCOL, family->name); |
| 855 | | | } |
| 856 | | | |
| 857 | | | if (check_col(pinfo->cinfo, COL_INFO)) { |
Event 9:
Skipping " if". check_col(...) evaluates to false.
hide
|
|
| 858 | | | if(subtype && family) { |
| 859 | | | col_set_str(pinfo->cinfo, COL_INFO, family->name); |
| 860 | | | col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", subtype->name); |
| 861 | | | } else { |
| 862 | | | col_set_str(pinfo->cinfo, COL_INFO, "SNAC data"); |
| 863 | | | |
| 864 | | | if(family) col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", family->name); |
| 865 | | | else col_append_fstr(pinfo->cinfo, COL_INFO, ", Family: 0x%04x", family_id); |
| 866 | | | |
| 867 | | | col_append_fstr(pinfo->cinfo, COL_INFO, ", Subtype: 0x%04x", subtype_id); |
| 868 | | | } |
| 869 | | | } |
| 870 | | | |
| 871 | | | if(aim_tree && family) |
Event 10:
aim_tree evaluates to true.
hide
Null Test After Dereference
This code tests the nullness of family, which has already been dereferenced. - If family were null, there would have been a prior null pointer dereference at packet-aim.c:818, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 5. Show: All events | Only primary events |
|
| 872 | | | { |
| 873 | | | proto_item *ti = proto_tree_add_item(root_tree, family->proto_id, subtvb, 0, -1, FALSE); |
| 874 | | | family_tree = proto_item_add_subtree(ti, family->ett); |
| 875 | | | if(subtype) proto_item_append_text(ti, ", %s", subtype->name); |
| 876 | | | } |
| 877 | | | |
| 878 | | | if(tvb_length_remaining(tvb, offset) > 0 && subtype && subtype->dissector) { |
| 879 | | | subtype->dissector(subtvb, pinfo, family_tree); |
| 880 | | | } |
| 881 | | | pinfo->private_data = pd_save; |
| 882 | | | } |
| |