(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dcerpc-epm.c) |
| |
| 162 | | | epm_dissect_ept_entry_t(tvbuff_t *tvb, int offset, |
| 163 | | | packet_info *pinfo, proto_tree *parent_tree, |
| 164 | | | guint8 *drep) |
| 165 | | | { |
| 166 | | | proto_item *item=NULL; |
| 167 | | | proto_tree *tree=NULL; |
| 168 | | | int old_offset=offset; |
| 169 | | | guint32 len; |
| 170 | | | gint slen; |
| 171 | | | dcerpc_info *di; |
| 172 | | | const char *str; |
| 173 | | | |
| 174 | | | di=pinfo->private_data; |
| 175 | | | if(di->conformant_run){ |
Event 1:
Skipping " if". di->conformant_run evaluates to false.
hide
|
|
| 176 | | | return offset; |
| 177 | | | } |
| 178 | | | |
| 179 | | | if(parent_tree){ |
Event 2:
Taking true branch. parent_tree evaluates to true.
hide
|
|
| 180 | | | item = proto_tree_add_text(parent_tree, tvb, offset, -1, "Entry:"); |
| 181 | [+] | | tree = proto_item_add_subtree(item, ett_epm_entry); |
 |
| 182 | | | } |
| 183 | | | |
| 184 | | | offset = dissect_ndr_uuid_t (tvb, offset, pinfo, tree, drep, |
| 185 | | | hf_epm_object, NULL); |
| 186 | | | |
| 187 | | | offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep, |
| 188 | | | epm_dissect_tower, NDR_POINTER_PTR, |
| 189 | | | "Tower pointer:", -1); |
| 190 | | | |
| 191 | | | offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, |
| 192 | | | hf_epm_ann_offset, NULL); |
| 193 | | | offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep, |
| 194 | | | hf_epm_ann_len, &len); |
| 195 | [+] | | str=(const char *)tvb_get_ptr(tvb, offset, -1); |
 |
| 196 | | | slen=len; |
| 197 | | | slen=MIN(slen,tvb_length_remaining(tvb, offset));
x /usr/include/glib-2.0/glib/gmacros.h |
| |
201 | #define MIN(a, b) (((a) < (b)) ? (a) : (b)) |
| |
|
Event 9:
slen < tvb_length_remaining(...) evaluates to false.
hide
|
|
| 198 | | | tvb_ensure_bytes_exist(tvb, offset, len); |
| 199 | | | proto_tree_add_item(tree, hf_epm_annotation, tvb, offset, len, TRUE); |
Event 10:
!0 evaluates to true.
hide
|
|
| 200 | | | offset += len; |
| 201 | | | |
| 202 | | | if(str&&str[0]){ |
| 203 | | | if(parent_tree) { |
Event 12:
Taking true branch. parent_tree evaluates to true.
hide
|
|
| 204 | | | proto_item_append_text(item, " Service:%*s ", slen, str); |
| 205 | | | proto_item_append_text(tree->parent, " Service:%*s ", slen, str); |
Null Pointer Dereference
tree is dereferenced here, but it is NULL. The issue can occur if the highlighted code executes. See related event 5. Show: All events | Only primary events |
|
| |