(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dcom.c) |
| |
| 1144 | | | dissect_dcom_SAFEARRAY(tvbuff_t *tvb, int offset, packet_info *pinfo, |
| 1145 | | | proto_tree *tree, guint8 *drep, int hfindex _U_, sa_callback_t sacb) |
| 1146 | | | { |
| 1147 | | | guint32 u32Dims; |
| 1148 | | | guint16 u16Dims; |
| 1149 | | | guint16 u16Features; |
| 1150 | | | guint32 u32ElementSize; |
| 1151 | | | guint32 u32VarType; |
| 1152 | | | guint32 u32Elements; |
| 1153 | | | guint32 u32Pointer; |
| 1154 | | | guint32 u32BoundElements; |
| 1155 | | | guint32 u32LowBound; |
| 1156 1165 |  | | [ Lines 1156 to 1165 omitted. ] |
| 1166 | | | proto_tree *sub_tree; |
| 1167 | | | guint32 u32SubStart; |
| 1168 | | | guint32 u32TmpOffset; |
| 1169 | | | |
| 1170 | | | proto_item *feature_item; |
| 1171 | | | proto_tree *feature_tree; |
| 1172 | | | |
| 1173 | | | |
| 1174 | | | |
| 1175 | | | |
| 1176 | | | sub_item = proto_tree_add_item(tree, hf_dcom_safearray, tvb, offset, 0, FALSE); |
| 1177 | | | sub_tree = proto_item_add_subtree(sub_item, ett_dcom_safearray); |
| 1178 | | | u32SubStart = offset; |
| 1179 | | | |
| 1180 | | | offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, drep, &u32Pointer); |
| 1181 | | | offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, drep, &u32Pointer); |
| 1182 | | | |
| 1183 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1184 | [+] | | hf_dcom_sa_dims32, &u32Dims); |
Event 1:
dissect_ndr_uint32() does not initialize u32Dims. - This may be because of a failure case or other special case for dissect_ndr_uint32().
hide
|
|
 |
| 1185 | | | offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, drep, |
| 1186 | | | hf_dcom_sa_dims16, &u16Dims); |
| 1187 | | | |
| 1188 | | | |
| 1189 | | | u32TmpOffset = dissect_dcom_WORD(tvb, offset, pinfo, NULL, drep, |
| 1190 | | | hf_dcom_sa_features, &u16Features); |
| 1191 | | | feature_item = proto_tree_add_uint (sub_tree, hf_dcom_sa_features, tvb, offset, 2, u16Features); |
| 1192 | [+] | | feature_tree = proto_item_add_subtree (feature_item, ett_dcom_sa_features); |
 |
| 1193 | | | if (feature_tree) { |
Event 4:
Skipping " if". feature_tree evaluates to false.
hide
|
|
| 1194 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_variant, tvb, offset, 2, u16Features); |
| 1195 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_dispatch, tvb, offset, 2, u16Features); |
| 1196 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_unknown, tvb, offset, 2, u16Features); |
| 1197 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_bstr, tvb, offset, 2, u16Features); |
| 1198 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_have_vartype, tvb, offset, 2, u16Features); |
| 1199 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_have_iid, tvb, offset, 2, u16Features); |
| 1200 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_record, tvb, offset, 2, u16Features); |
| 1201 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_fixedsize, tvb, offset, 2, u16Features); |
| 1202 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_embedded, tvb, offset, 2, u16Features); |
| 1203 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_static, tvb, offset, 2, u16Features); |
| 1204 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_auto, tvb, offset, 2, u16Features); |
| 1205 | | | } |
| 1206 | | | offset = u32TmpOffset; |
| 1207 | | | |
| 1208 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1209 | | | hf_dcom_sa_element_size, &u32ElementSize); |
| 1210 | | | offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, drep, |
| 1211 | | | hf_dcom_sa_locks, &u16Locks); |
| 1212 | | | offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, drep, |
| 1213 | | | hf_dcom_sa_vartype16, &u16VarType); |
| 1214 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1215 | | | hf_dcom_sa_vartype32, &u32VarType); |
| 1216 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1217 | | | hf_dcom_sa_elements, &u32Elements); |
| 1218 | | | offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, drep, &u32Pointer); |
| 1219 | | | |
| 1220 | | | while(u32Dims--) { |
Uninitialized Variable
u32Dims was not initialized. The issue can occur if the highlighted code executes. See related event 1. Show: All events | Only primary events |
|
| |