(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-beep.c) |
| |
| 830 | | | dissect_beep(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) |
| 831 | | | { |
| 832 | | | int offset; |
| 833 | | | struct beep_proto_data *beep_frame_data = NULL; |
| 834 | | | proto_tree *beep_tree = NULL, *ti = NULL; |
| 835 | | | conversation_t *conversation = NULL; |
| 836 | | | struct beep_request_key request_key, *new_request_key; |
| 837 | | | struct beep_request_val *request_val = NULL; |
| 838 | | | |
| 839 | | | offset = 0; |
| 840 | | | |
| 841 | | | |
| 842 | | | |
| 843 | | | |
| 844 | | | |
| 845 | | | |
| 846 | | | |
| 847 | | | |
| 848 | | | |
| 849 | | | |
| 850 | | | |
| 851 | | | |
| 852 | | | |
| 853 | | | |
| 854 | | | |
| 855 | | | |
| 856 | | | |
| 857 | | | |
| 858 | | | |
| 859 | | | |
| 860 | | | |
| 861 | | | |
| 862 | | | |
| 863 | | | beep_frame_data = p_get_proto_data(pinfo->fd, proto_beep); |
| 864 | | | |
| 865 | | | if (!beep_frame_data) { |
Event 1:
Skipping " if". beep_frame_data evaluates to true.
hide
|
|
| 866 | | | |
| 867 | | | conversation = find_conversation(pinfo->fd->num, &pinfo->src, &pinfo->dst, pinfo->ptype, |
| 868 | | | pinfo->srcport, pinfo->destport, 0); |
| 869 | | | if (conversation == NULL) { |
| 870 | | | conversation = conversation_new(pinfo->fd->num, &pinfo->src, &pinfo->dst, pinfo->ptype, |
| 871 | | | pinfo->srcport, pinfo->destport, 0); |
| 872 | | | |
| 873 | | | } |
| 874 | | | |
| 875 | | | |
| 876 | | | |
| 877 | | | |
| 878 | | | request_key.conversation = conversation->index; |
| 879 | | | |
| 880 | | | request_val = (struct beep_request_val *)g_hash_table_lookup(beep_request_hash, &request_key); |
| 881 | | | |
| 882 | | | if (!request_val) { |
| 883 | | | |
| 884 | | | new_request_key = se_alloc(sizeof(struct beep_request_key)); |
| 885 | | | new_request_key->conversation = conversation->index; |
| 886 | | | |
| 887 | | | request_val = se_alloc(sizeof(struct beep_request_val)); |
| 888 | | | request_val->processed = 0; |
| 889 | | | request_val->size = 0; |
| 890 | | | |
| 891 | | | g_hash_table_insert(beep_request_hash, new_request_key, request_val); |
| 892 | | | |
| 893 | | | } |
| 894 | | | } |
| 895 | | | |
| 896 | | | if (check_col(pinfo->cinfo, COL_PROTOCOL)) |
Event 2:
Skipping " if". check_col(...) evaluates to false.
hide
|
|
| 897 | | | col_set_str(pinfo->cinfo, COL_PROTOCOL, "BEEP"); |
| 898 | | | |
| 899 | | | if (check_col(pinfo->cinfo, COL_INFO)) { |
Event 3:
Skipping " if". check_col(...) evaluates to false.
hide
|
|
| 900 | | | |
| 901 | | | |
| 902 | | | |
| 903 | | | col_add_str(pinfo->cinfo, COL_INFO, tvb_format_text(tvb, offset, tvb_length_remaining(tvb, offset))); |
| 904 | | | |
| 905 | | | } |
| 906 | | | |
| 907 | | | |
| 908 | | | |
| 909 | | | |
| 910 | | | |
| 911 | | | |
| 912 | | | |
| 913 | | | |
| 914 | | | |
| 915 | | | |
| 916 | | | |
| 917 | | | if (tree) { |
Event 4:
Skipping " if". tree evaluates to false.
hide
|
|
| 918 | | | |
| 919 | | | ti = proto_tree_add_item(tree, proto_beep, tvb, offset, -1, FALSE); |
| 920 | | | |
| 921 | | | beep_tree = proto_item_add_subtree(ti, ett_beep); |
| 922 | | | |
| 923 | | | } |
| 924 | | | |
| 925 | | | |
| 926 | | | |
| 927 | | | |
| 928 | | | |
| 929 | | | |
| 930 | | | |
| 931 | | | |
| 932 | | | |
| 933 | | | |
| 934 | | | |
| 935 | | | |
| 936 | | | |
| 937 | | | if (beep_frame_data && beep_frame_data->pl_left > 0) { |
| 938 | | | |
| 939 | | | int pl_left = beep_frame_data->pl_left; |
| 940 | | | |
| 941 | | | pl_left = MIN(pl_left, tvb_length_remaining(tvb, offset));
x /usr/include/glib-2.0/glib/gmacros.h |
| |
201 | #define MIN(a, b) (((a) < (b)) ? (a) : (b)) |
| |
|
| 942 | | | |
| 943 | | | |
| 944 | | | if (tree) { |
| 945 | | | proto_tree_add_text(beep_tree, tvb, offset, pl_left, "Payload: %s", |
| 946 | | | tvb_format_text(tvb, offset, pl_left)); |
| 947 | | | } |
| 948 | | | offset += pl_left; |
| 949 | | | } |
| 950 | | | else if (request_val && request_val->size > 0) { |
Event 7:
Skipping " if". request_val evaluates to false.
hide
|
|
| 951 | | | |
| 952 | | | int pl_left = request_val->size; |
| 953 | | | |
| 954 | | | request_val->size = 0; |
| 955 | | | |
| 956 | | | |
| 957 | | | |
| 958 | | | |
| 959 | | | |
| 960 | | | beep_frame_data = se_alloc(sizeof(struct beep_proto_data)); |
| 961 | | | |
| 962 | | | beep_frame_data->pl_left = pl_left; |
| 963 | | | beep_frame_data->pl_size = 0; |
| 964 | | | beep_frame_data->mime_hdr = 0; |
| 965 | | | |
| 966 | | | p_add_proto_data(pinfo->fd, proto_beep, beep_frame_data); |
| 967 | | | |
| 968 | | | } |
| 969 | | | |
| 970 | | | |
| 971 | | | |
| 972 | | | |
| 973 | | | |
| 974 | | | if (beep_frame_data == NULL) { |
Null Test After Dereference
This code tests the nullness of beep_frame_data, which has already been dereferenced. - If beep_frame_data were null, there would have been a prior null pointer dereference at packet-beep.c:937, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 6. Show: All events | Only primary events |
|
| 975 | | | |
| 976 | | | beep_frame_data = se_alloc(sizeof(struct beep_proto_data)); |
| 977 | | | |
| 978 | | | beep_frame_data->pl_left = 0; |
| 979 | | | beep_frame_data->pl_size = 0; |
| 980 | | | beep_frame_data->mime_hdr = 0; |
| 981 | | | |
| 982 | | | p_add_proto_data(pinfo->fd, proto_beep, beep_frame_data); |
| 983 | | | |
| 984 | | | } |
| 985 | | | |
| 986 | | | if (tvb_length_remaining(tvb, offset) > 0) { |
| 987 | | | |
| 988 | | | offset += dissect_beep_tree(tvb, offset, pinfo, beep_tree, request_val, beep_frame_data); |
| 989 | | | |
| 990 | | | } |
| 991 | | | |
| 992 | | | } |
| |