(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-ipmi-se.c) |
| |
| 1786 | | | parse_platform_event(tvbuff_t *tvb, proto_tree *tree) |
| 1787 | | | { |
| 1788 | | | proto_item *ti; |
| 1789 | | | proto_tree *s_tree; |
| 1790 | | | tvbuff_t *next_tvb; |
| 1791 | | | unsigned int stype, evtype; |
| 1792 | | | const struct sensor_info *si; |
| 1793 | | | const struct evtype_info *eti; |
| 1794 | | | unsigned int d, b2, b3, offs; |
| 1795 | | | const value_string *off_vals; |
| 1796 | | | |
| 1797 | | | stype = tvb_get_guint8(tvb, 1); |
| 1798 | | | si = get_sensor_info(stype); |
| 1799 | | | evtype = tvb_get_guint8(tvb, 3) & 0x7f; |
| 1800 | | | eti = get_evtype_info(evtype); |
| 1801 | | | |
| 1802 | | | proto_tree_add_item(tree, hf_ipmi_se_evt_rev, tvb, 0, 1, TRUE); |
Event 1:
!0 evaluates to true.
hide
|
|
| 1803 | | | proto_tree_add_uint_format_value(tree, hf_ipmi_se_evt_sensor_type, tvb, 1, 1, stype, |
| 1804 | | | "%s (0x%02x)", si->desc, stype); |
| 1805 | | | proto_tree_add_item(tree, hf_ipmi_se_evt_sensor_num, tvb, 2, 1, TRUE); |
Event 2:
!0 evaluates to true.
hide
|
|
| 1806 | | | ti = proto_tree_add_item(tree, hf_ipmi_se_evt_byte3, tvb, 3, 1, TRUE); |
Event 3:
!0 evaluates to true.
hide
|
|
| 1807 | | | s_tree = proto_item_add_subtree(ti, ett_ipmi_se_evt_byte3); |
| 1808 | | | proto_tree_add_item(s_tree, hf_ipmi_se_evt_dir, tvb, 3, 1, TRUE); |
Event 4:
!0 evaluates to true.
hide
|
|
| 1809 | | | proto_tree_add_uint_format(s_tree, hf_ipmi_se_evt_type, tvb, 3, 1, evtype, |
| 1810 | | | "%sEvent/Reading type: %s (0x%02x)", ipmi_dcd8(evtype, 0x7f), |
| 1811 | | | eti->desc, evtype); |
| 1812 | | | |
| 1813 | | | offs = tvb_get_guint8(tvb, 4); |
| 1814 | | | b2 = offs >> 6; |
| 1815 | | | b3 = (offs >> 4) & 0x3; |
| 1816 | | | off_vals = eti->offsets ? eti->offsets : si->offsets ? si->offsets : et_empty; |
Event 5:
eti->offsets evaluates to false.
hide
Event 6:
si->offsets evaluates to false.
hide
Event 7:
off_vals is set to eti->offsets ? eti->offsets : si->offsets ? si->offsets : et_empty, which evaluates to et_empty. - This points to the buffer that will be overrun later.
hide
|
|
| 1817 | | | |
| 1818 | | | ti = proto_tree_add_item(tree, hf_ipmi_se_evt_data1, tvb, 4, 1, TRUE); |
Event 8:
!0 evaluates to true.
hide
|
|
| 1819 | | | s_tree = proto_item_add_subtree(ti, ett_ipmi_se_evt_evd_byte1); |
| 1820 | | | proto_tree_add_uint_format(s_tree, hf_ipmi_se_evt_data1_b2, tvb, 4, 1, b2 << 6, |
| 1821 | | | "%sByte 2: %s (0x%02x)", |
| 1822 | | | ipmi_dcd8(offs, 0xc0), val_to_str(b2, eti->byte2, "Reserved"), b2); |
| 1823 | | | proto_tree_add_uint_format(s_tree, hf_ipmi_se_evt_data1_b3, tvb, 4, 1, b3 << 4, |
| 1824 | | | "%sByte 3: %s (0x%02x)", |
| 1825 | | | ipmi_dcd8(offs, 0x30), val_to_str(b3, eti->byte3, "Reserved"), b3); |
| 1826 | | | offs &= 0x0f; |
| 1827 | | | proto_tree_add_uint_format(s_tree, hf_ipmi_se_evt_data1_offs, tvb, 4, 1, offs, |
| 1828 | | | "%sOffset: %s (0x%02x)", |
| 1829 | [+] | | ipmi_dcd8(offs, 0x0f), val_to_str(offs, off_vals, "Reserved"), offs); |
Event 9:
off_vals, which evaluates to et_empty, is passed to val_to_str() as the second argument. See related event 7.
hide
|
|
 |
| |