(/home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/gryphon/packet-gryphon.c) |
| |
| 731 | | | decode_data(tvbuff_t *tvb, int offset, proto_tree *pt) |
| 732 | | | { |
| 733 | | | proto_item *item, *item1; |
| 734 | | | proto_tree *tree, *tree1; |
| 735 | | | int hdrsize, datasize, , hdrbits, msgsize, padding, mode; |
| 736 | | | int hours, minutes, seconds, fraction; |
| 737 | | | unsigned long timestamp; |
| 738 | | | |
| 739 | | | hdrsize = tvb_get_guint8(tvb, offset+0); |
| 740 | | | hdrbits = tvb_get_guint8(tvb, offset+1); |
| 741 | | | datasize = tvb_get_ntohs(tvb, offset+2); |
| 742 | | | = tvb_get_guint8(tvb, offset+4); |
| 743 | | | padding = 3 - (hdrsize + datasize + + 3) % 4; |
| 744 | | | msgsize = hdrsize + datasize + + padding + 16; |
| 745 | | | |
| 746 | | | item = proto_tree_add_text(pt, tvb, offset, 16, "Message "); |
| 747 | | | tree = proto_item_add_subtree (item, ); |
| 748 | | | proto_tree_add_text(tree, tvb, offset, 2, " length: %d byte%s, %d bits", |
| 749 | | | hdrsize, plurality(hdrsize, "", "s"), hdrbits); |
Event 1:
hdrsize == 1 evaluates to true.
hide
|
|
| 750 | | | proto_tree_add_text(tree, tvb, offset+2, 2, "Data length: %d byte%s", |
| 751 | | | datasize, plurality(datasize, "", "s")); |
Event 2:
datasize == 1 evaluates to false.
hide
|
|
| 752 | | | proto_tree_add_text(tree, tvb, offset+4, 1, " data length: %d byte%s", |
| 753 | | | , plurality(, "", "s")); |
Event 3:
== 1 evaluates to false.
hide
|
|
| 754 | [+] | | mode = tvb_get_guint8(tvb, offset+5); |
 |
| 755 | | | item1 = proto_tree_add_text(tree, tvb, offset+5, 1, "Mode: %d", mode); |
| 756 | | | if (mode) { |
Event 18:
Taking true branch. mode evaluates to true.
hide
|
|
| 757 | | | tree1 = proto_item_add_subtree (item1, ett_gryphon_flags); |
| 758 | | | if (mode & 0x80) { |
Event 19:
Taking true branch. mode & 128 evaluates to true.
hide
|
|
| 759 | | | proto_tree_add_text(tree1, tvb, offset+5, 1, "%s", |
| 760 | | | decode_boolean_bitfield(mode, 0x80, 8, |
| 761 | [+] | | "Transmitted message", NULL)); |
Event 20:
NULL is passed to decode_boolean_bitfield() as the fifth argument. - Dereferenced later, causing the null pointer dereference.
hide
|
|
 |
| |