(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-tcp.c) |
| |
| 1534 | | | desegment_tcp(tvbuff_t *tvb, packet_info *pinfo, int offset, |
| 1535 | | | guint32 seq, guint32 nxtseq, |
| 1536 | | | guint32 sport, guint32 dport, |
| 1537 | | | proto_tree *tree, proto_tree *tcp_tree, |
| 1538 | | | struct tcp_analysis *tcpd) |
| 1539 | | | { |
| 1540 | | | struct tcpinfo *tcpinfo = pinfo->private_data; |
| 1541 | | | fragment_data *ipfd_head; |
| 1542 | | | int last_fragment_len; |
| 1543 | | | gboolean must_desegment; |
| 1544 | | | gboolean called_dissector; |
| 1545 | | | int another_pdu_follows; |
| 1546 | | | int deseg_offset; |
| 1547 | | | guint32 deseg_seq; |
| 1548 | | | gint nbytes; |
| 1549 | | | proto_item *item; |
| 1550 | | | struct tcp_multisegment_pdu *msp; |
| 1551 | | | |
| 1552 | | | again: |
| 1553 | | | ipfd_head=NULL; |
| 1554 | | | last_fragment_len=0; |
| 1555 | | | must_desegment = FALSE; |
| 1556 | | | called_dissector = FALSE; |
| 1557 | | | another_pdu_follows = 0; |
| 1558 | | | msp=NULL; |
| 1559 | | | |
| 1560 | | | |
| 1561 | | | |
| 1562 | | | |
| 1563 | | | |
| 1564 | | | |
| 1565 | | | pinfo->desegment_offset = 0; |
| 1566 | | | pinfo->desegment_len = 0; |
| 1567 | | | |
| 1568 | | | |
| 1569 | | | |
| 1570 | | | |
| 1571 | | | |
| 1572 | | | |
| 1573 | | | |
| 1574 | | | deseg_offset = offset; |
| 1575 | | | |
| 1576 | | | |
| 1577 | | | if (tcpd) { |
Event 1:
Taking true branch. tcpd evaluates to true.
hide
|
|
| 1578 | | | msp = se_tree_lookup32_le(tcpd->fwd->multisegment_pdus, seq-1); |
| 1579 | | | } |
| 1580 | | | if(msp && msp->seq<=seq && msp->nxtpdu>seq){ |
Event 3:
Taking false branch. msp evaluates to false.
hide
|
|
| 1581 | | | int len; |
| 1582 | | | |
| 1583 | | | if(!pinfo->fd->flags.visited){ |
| 1584 | | | msp->last_frame=pinfo->fd->num; |
| 1585 | | | msp->last_frame_time=pinfo->fd->abs_ts; |
| 1586 | | | } |
| 1587 | | | |
| 1588 | | | |
| 1589 | | | |
| 1590 | | | |
| 1591 | | | if(msp->flags&MSP_FLAGS_REASSEMBLE_ENTIRE_SEGMENT){ |
| 1592 | | | |
| 1593 | | | len=tvb_length_remaining(tvb, offset); |
| 1594 | | | } else { |
| 1595 | | | len=MIN(nxtseq, msp->nxtpdu) - seq;
x /usr/include/glib-2.0/glib/gmacros.h |
| |
201 | #define MIN(a, b) (((a) < (b)) ? (a) : (b)) |
| |
|
| 1596 | | | } |
| 1597 | | | last_fragment_len = len; |
| 1598 | | | |
| 1599 | | | ipfd_head = fragment_add(tvb, offset, pinfo, msp->first_frame, |
| 1600 | | | tcp_fragment_table, |
| 1601 | | | seq - msp->seq, |
| 1602 | | | len, |
| 1603 | | | (LT_SEQ (nxtseq,msp->nxtpdu)) ); |
| 1604 | | | |
| 1605 | | | if(msp->flags&MSP_FLAGS_REASSEMBLE_ENTIRE_SEGMENT){ |
| 1606 | | | msp->flags&=(~MSP_FLAGS_REASSEMBLE_ENTIRE_SEGMENT); |
| 1607 | | | |
| 1608 | | | |
| 1609 | | | |
| 1610 | | | |
| 1611 | | | |
| 1612 | | | |
| 1613 | | | |
| 1614 | | | |
| 1615 | | | |
| 1616 | | | msp->nxtpdu=nxtseq; |
| 1617 | | | } |
| 1618 | | | |
| 1619 | | | if( (msp->nxtpdu<nxtseq) |
| 1620 | | | && (msp->nxtpdu>=seq) |
| 1621 | | | && (len>0) ){ |
| 1622 | | | another_pdu_follows=msp->nxtpdu-seq; |
| 1623 | | | } |
| 1624 | | | } else { |
| 1625 | | | |
| 1626 | | | |
| 1627 | | | |
| 1628 | | | |
| 1629 | | | process_tcp_payload(tvb, offset, pinfo, tree, tcp_tree, |
| 1630 | | | sport, dport, 0, 0, FALSE, tcpd); |
| 1631 | | | called_dissector = TRUE; |
Event 4:
!0 evaluates to true.
hide
|
|
| 1632 | | | |
| 1633 | | | |
| 1634 | | | |
| 1635 | | | |
| 1636 | | | |
| 1637 | | | |
| 1638 | | | |
| 1639 | | | if(pinfo->desegment_len) { |
Event 5:
Taking true branch. pinfo->desegment_len evaluates to true.
hide
|
|
| 1640 | | | if (!pinfo->fd->flags.visited) |
Event 6:
Taking true branch. pinfo->fd->flags.visited evaluates to false.
hide
|
|
| 1641 | | | must_desegment = TRUE; |
Event 7:
!0 evaluates to true.
hide
|
|
| 1642 | | | |
| 1643 | | | |
| 1644 | | | |
| 1645 | | | |
| 1646 | | | |
| 1647 | | | |
| 1648 | | | deseg_offset = offset + pinfo->desegment_offset; |
| 1649 | | | } |
| 1650 | | | |
| 1651 | | | |
| 1652 | | | |
| 1653 | | | |
| 1654 | | | |
| 1655 | | | |
| 1656 | | | ipfd_head = NULL; |
| 1657 | | | } |
| 1658 | | | |
| 1659 | | | |
| 1660 | | | |
| 1661 | | | if(ipfd_head){ |
Event 8:
Skipping " if". ipfd_head evaluates to false.
hide
|
|
| 1662 | | | |
| 1663 | | | |
| 1664 | | | |
| 1665 | | | |
| 1666 | | | |
| 1667 | | | |
| 1668 | | | if(ipfd_head->reassembled_in==pinfo->fd->num){ |
| 1669 | | | |
| 1670 | | | |
| 1671 | | | |
| 1672 | | | |
| 1673 | | | |
| 1674 | | | tvbuff_t *next_tvb; |
| 1675 | | | int old_len; |
| 1676 | | | |
| 1677 | | | |
| 1678 | | | next_tvb = tvb_new_child_real_data(tvb, ipfd_head->data, |
| 1679 | | | ipfd_head->datalen, ipfd_head->datalen); |
| 1680 | | | |
| 1681 | | | |
| 1682 | | | |
| 1683 | | | add_new_data_source(pinfo, next_tvb, "Reassembled TCP"); |
| 1684 | | | |
| 1685 | | | |
| 1686 | | | |
| 1687 | | | |
| 1688 | | | |
| 1689 | | | tcpinfo->seq = msp->seq; |
| 1690 | | | |
| 1691 | | | |
| 1692 | | | tcpinfo->is_reassembled = TRUE; |
| 1693 | | | |
| 1694 | | | |
| 1695 | | | process_tcp_payload(next_tvb, 0, pinfo, tree, |
| 1696 | | | tcp_tree, sport, dport, 0, 0, FALSE, tcpd); |
| 1697 | | | called_dissector = TRUE; |
| 1698 | | | |
| 1699 | | | |
| 1700 | | | |
| 1701 | | | |
| 1702 | | | |
| 1703 | | | |
| 1704 | | | old_len=(int)(tvb_reported_length(next_tvb)-last_fragment_len); |
| 1705 | | | if(pinfo->desegment_len && |
| 1706 | | | pinfo->desegment_offset<=old_len){ |
| 1707 | | | |
| 1708 | | | |
| 1709 | | | |
| 1710 | | | |
| 1711 | | | |
| 1712 | | | |
| 1713 | | | |
| 1714 | | | |
| 1715 | | | |
| 1716 | | | |
| 1717 | | | |
| 1718 | | | fragment_set_partial_reassembly(pinfo,msp->first_frame,tcp_fragment_table); |
| 1719 | | | |
| 1720 | | | |
| 1721 | | | |
| 1722 | | | if(pinfo->desegment_len==DESEGMENT_ONE_MORE_SEGMENT){ |
| 1723 | | | |
| 1724 | | | |
| 1725 | | | |
| 1726 | | | |
| 1727 | | | |
| 1728 | | | |
| 1729 | | | |
| 1730 | | | |
| 1731 | | | msp->nxtpdu=seq+tvb_reported_length_remaining(tvb, offset) + 1; |
| 1732 | | | msp->flags|=MSP_FLAGS_REASSEMBLE_ENTIRE_SEGMENT; |
| 1733 | | | } else { |
| 1734 | | | msp->nxtpdu=seq + last_fragment_len + pinfo->desegment_len; |
| 1735 | | | } |
| 1736 | | | |
| 1737 | | | |
| 1738 | | | |
| 1739 | | | |
| 1740 | | | another_pdu_follows=0; |
| 1741 | | | offset += last_fragment_len; |
| 1742 | | | seq += last_fragment_len; |
| 1743 | | | if (tvb_length_remaining(tvb, offset) > 0) |
| 1744 | | | goto again; |
| 1745 | | | } else { |
| 1746 | | | |
| 1747 | | | |
| 1748 | | | |
| 1749 | | | |
| 1750 | | | nbytes = another_pdu_follows > 0 |
| 1751 | | | ? another_pdu_follows |
| 1752 | | | : tvb_reported_length_remaining(tvb, offset); |
| 1753 | | | proto_tree_add_text(tcp_tree, tvb, offset, nbytes, |
| 1754 | | | "TCP segment data (%u byte%s)", nbytes, |
| 1755 | | | plurality(nbytes, "", "s")); |
| 1756 | | | |
| 1757 | | | print_tcp_fragment_tree(ipfd_head, tree, tcp_tree, pinfo, next_tvb); |
| 1758 | | | |
| 1759 | | | |
| 1760 | | | |
| 1761 | | | |
| 1762 | | | |
| 1763 | | | |
| 1764 | | | |
| 1765 | | | |
| 1766 | | | |
| 1767 | | | |
| 1768 | | | |
| 1769 | | | |
| 1770 | | | if(pinfo->desegment_len) { |
| 1771 | | | if (!pinfo->fd->flags.visited) |
| 1772 | | | must_desegment = TRUE; |
| 1773 | | | |
| 1774 | | | |
| 1775 | | | |
| 1776 | | | |
| 1777 | | | |
| 1778 | | | |
| 1779 | | | |
| 1780 | | | |
| 1781 | | | |
| 1782 | | | |
| 1783 | | | |
| 1784 | | | |
| 1785 | | | |
| 1786 | | | |
| 1787 | | | |
| 1788 | | | |
| 1789 | | | |
| 1790 | | | |
| 1791 | | | |
| 1792 | | | |
| 1793 | | | deseg_offset = |
| 1794 | | | ipfd_head->datalen - pinfo->desegment_offset; |
| 1795 | | | |
| 1796 | | | |
| 1797 | | | |
| 1798 | | | |
| 1799 | | | |
| 1800 | | | |
| 1801 | | | |
| 1802 | | | |
| 1803 | | | |
| 1804 | | | |
| 1805 | | | |
| 1806 | | | |
| 1807 | | | |
| 1808 | | | |
| 1809 | | | |
| 1810 | | | deseg_offset=tvb_reported_length(tvb) - deseg_offset; |
| 1811 | | | } |
| 1812 | | | } |
| 1813 | | | } |
| 1814 | | | } |
| 1815 | | | |
| 1816 | | | if (must_desegment) { |
Event 9:
Taking true branch. must_desegment evaluates to true.
hide
|
|
| 1817 | | | |
| 1818 | | | |
| 1819 | | | |
| 1820 | | | |
| 1821 | | | |
| 1822 | | | |
| 1823 | | | if(tcpd && pinfo->desegment_len==DESEGMENT_UNTIL_FIN) { |
Event 10:
Skipping " if". - tcpd evaluates to true.
- pinfo->desegment_len == 268435454 evaluates to false.
hide
|
|
| 1824 | | | tcpd->fwd->flags|=TCP_FLOW_REASSEMBLE_UNTIL_FIN; |
| 1825 | | | } |
| 1826 | | | |
| 1827 | | | |
| 1828 | | | |
| 1829 | | | |
| 1830 | | | |
| 1831 | | | |
| 1832 | | | |
| 1833 | | | |
| 1834 | | | |
| 1835 | | | |
| 1836 | | | deseg_seq = seq + (deseg_offset - offset); |
| 1837 | | | |
| 1838 | | | if(tcpd && ((nxtseq - deseg_seq) <= 1024*1024) |
Null Test After Dereference
This code tests the nullness of tcpd, which has already been dereferenced. - If tcpd were null, there would have been a prior null pointer dereference at packet-tcp.c:1578, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 2. Show: All events | Only primary events |
|
| 1839 | | | && (!pinfo->fd->flags.visited) ){ |
| 1840 | | | if(pinfo->desegment_len==DESEGMENT_ONE_MORE_SEGMENT){ |
| 1841 | | | |
| 1842 | | | |
| 1843 | | | |
| 1844 | | | |
| 1845 | | | |
| 1846 | | | |
| 1847 | | | msp = pdu_store_sequencenumber_of_next_pdu(pinfo, |
| 1848 | | | deseg_seq, nxtseq+1, tcpd->fwd->multisegment_pdus); |
| 1849 | | | msp->flags|=MSP_FLAGS_REASSEMBLE_ENTIRE_SEGMENT; |
| 1850 | | | } else { |
| 1851 | | | msp = pdu_store_sequencenumber_of_next_pdu(pinfo, |
| 1852 | | | deseg_seq, nxtseq+pinfo->desegment_len, tcpd->fwd->multisegment_pdus); |
| 1853 | | | } |
| 1854 | | | |
| 1855 | | | |
| 1856 | | | fragment_add(tvb, deseg_offset, pinfo, msp->first_frame, |
| 1857 | | | tcp_fragment_table, |
| 1858 | | | 0, |
| 1859 | | | nxtseq - deseg_seq, |
| 1860 | | | LT_SEQ(nxtseq, msp->nxtpdu)); |
| 1861 | | | } |
| 1862 | | | } |
| 1863 | | | |
| 1864 | | | if (!called_dissector || pinfo->desegment_len != 0) { |
| 1865 | | | if (ipfd_head != NULL && ipfd_head->reassembled_in != 0 && |
| 1866 | | | !(ipfd_head->flags & FD_PARTIAL_REASSEMBLY)) { |
| 1867 | | | |
| 1868 | | | |
| 1869 | | | |
| 1870 | | | |
| 1871 | | | item=proto_tree_add_uint(tcp_tree, hf_tcp_reassembled_in, |
| 1872 | | | tvb, 0, 0, ipfd_head->reassembled_in); |
| 1873 | | | PROTO_ITEM_SET_GENERATED(item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
325 | #define PROTO_ITEM_SET_GENERATED(proto_item) \ |
326 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_GENERATED) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
| 1874 | | | } |
| 1875 | | | |
| 1876 | | | |
| 1877 | | | |
| 1878 | | | |
| 1879 | | | |
| 1880 | | | |
| 1881 | | | |
| 1882 | | | |
| 1883 | | | |
| 1884 | | | |
| 1885 | | | if (pinfo->desegment_offset == 0) { |
| 1886 | | | |
| 1887 | | | |
| 1888 | | | |
| 1889 | | | |
| 1890 | | | |
| 1891 | | | |
| 1892 | | | |
| 1893 | | | if (check_col(pinfo->cinfo, COL_PROTOCOL)){ |
| 1894 | | | col_set_str(pinfo->cinfo, COL_PROTOCOL, "TCP"); |
| 1895 | | | } |
| 1896 | | | if (check_col(pinfo->cinfo, COL_INFO)){ |
| 1897 | | | col_set_str(pinfo->cinfo, COL_INFO, "[TCP segment of a reassembled PDU]"); |
| 1898 | | | } |
| 1899 | | | } |
| 1900 | | | |
| 1901 | | | |
| 1902 | | | |
| 1903 | | | |
| 1904 | | | |
| 1905 | | | |
| 1906 | | | |
| 1907 | | | nbytes = tvb_reported_length_remaining(tvb, deseg_offset); |
| 1908 | | | proto_tree_add_text(tcp_tree, tvb, deseg_offset, -1, |
| 1909 | | | "TCP segment data (%u byte%s)", nbytes, |
| 1910 | | | plurality(nbytes, "", "s")); |
| 1911 | | | } |
| 1912 | | | pinfo->can_desegment=0; |
| 1913 | | | pinfo->desegment_offset = 0; |
| 1914 | | | pinfo->desegment_len = 0; |
| 1915 | | | |
| 1916 | | | if(another_pdu_follows){ |
| 1917 | | | |
| 1918 | | | pinfo->can_desegment=2; |
| 1919 | | | |
| 1920 | | | |
| 1921 | | | |
| 1922 | | | |
| 1923 | | | |
| 1924 | | | |
| 1925 | | | |
| 1926 | | | col_set_fence(pinfo->cinfo, COL_INFO); |
| 1927 | | | col_set_writable(pinfo->cinfo, FALSE); |
| 1928 | | | offset += another_pdu_follows; |
| 1929 | | | seq += another_pdu_follows; |
| 1930 | | | goto again; |
| 1931 | | | } |
| 1932 | | | } |
| |