(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-tcp.c) |
| |
| 2519 | | | dissect_tcpopt_snack(const ip_tcp_opt *optp, tvbuff_t *tvb, |
| 2520 | | | int offset, guint optlen, packet_info *pinfo, |
| 2521 | | | proto_tree *opt_tree) |
| 2522 | | | { |
| 2523 | | | struct tcp_analysis *tcpd=NULL; |
| 2524 | | | guint16 relative_hole_offset; |
| 2525 | | | guint16 relative_hole_size; |
| 2526 | | | guint16 base_mss = 0; |
| 2527 | | | guint32 ack; |
| 2528 | | | guint32 hole_start; |
| 2529 | | | guint32 hole_end; |
| 2530 | | | char null_modifier[] = "\0"; |
| 2531 | | | char relative_modifier[] = "(relative)"; |
| 2532 | | | char *modifier = null_modifier; |
| 2533 | | | proto_item *hidden_item; |
| 2534 | | | |
| 2535 | [+] | | tcpd = get_tcp_conversation_data(NULL,pinfo); |
 |
| 2536 | | | |
| 2537 | | | |
| 2538 | | | relative_hole_offset = tvb_get_ntohs(tvb, offset + 2); |
| 2539 | | | relative_hole_size = tvb_get_ntohs(tvb, offset + 4); |
| 2540 | | | |
| 2541 | | | hidden_item = proto_tree_add_boolean(opt_tree, hf_tcp_option_snack, tvb, |
| 2542 | | | offset, optlen, TRUE); |
Event 6:
!0 evaluates to true.
hide
|
|
| 2543 | | | PROTO_ITEM_SET_HIDDEN(hidden_item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
319 | #define PROTO_ITEM_SET_HIDDEN(proto_item) \ |
320 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_HIDDEN) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
Event 7:
hidden_item evaluates to false.
hide
|
|
| 2544 | | | |
| 2545 | | | hidden_item = proto_tree_add_uint(opt_tree, hf_tcp_option_snack_offset, |
| 2546 | | | tvb, offset, optlen, relative_hole_offset); |
| 2547 | | | PROTO_ITEM_SET_HIDDEN(hidden_item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
319 | #define PROTO_ITEM_SET_HIDDEN(proto_item) \ |
320 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_HIDDEN) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
Event 8:
hidden_item evaluates to false.
hide
|
|
| 2548 | | | |
| 2549 | | | hidden_item = proto_tree_add_uint(opt_tree, hf_tcp_option_snack_size, |
| 2550 | | | tvb, offset, optlen, relative_hole_size); |
| 2551 | | | PROTO_ITEM_SET_HIDDEN(hidden_item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
319 | #define PROTO_ITEM_SET_HIDDEN(proto_item) \ |
320 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_HIDDEN) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
Event 9:
hidden_item evaluates to false.
hide
|
|
| 2552 | | | proto_tree_add_text(opt_tree, tvb, offset, optlen, |
| 2553 | | | "%s: Offset %u, Size %u", optp->name, |
| 2554 | | | relative_hole_offset, relative_hole_size); |
| 2555 | | | |
| 2556 | | | ack = tvb_get_ntohl(tvb, 8); |
| 2557 | | | |
| 2558 | | | if (tcp_relative_seq) { |
Event 10:
Skipping " if". tcp_relative_seq evaluates to false.
hide
|
|
| 2559 | | | ack -= tcpd->rev->base_seq; |
| 2560 | | | modifier = relative_modifier; |
| 2561 | | | } |
| 2562 | | | |
| 2563 | | | |
| 2564 | | | |
| 2565 | | | |
| 2566 | | | |
| 2567 | | | |
| 2568 | | | |
| 2569 | | | |
| 2570 | | | base_mss = tcpd->fwd->maxsizeacked; |
Null Pointer Dereference
tcpd is dereferenced here, but it is NULL. The issue can occur if the highlighted code executes. See related event 5. Show: All events | Only primary events |
|
| |