(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-x11.c) |
| |
| 4394 | | | dissect_x11_replies(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) |
| 4395 | | | { |
| 4396 | | | |
| 4397 | | | volatile int offset, plen; |
| 4398 | | | tvbuff_t * volatile next_tvb; |
| 4399 | | | conversation_t *conversation; |
| 4400 | | | x11_conv_data_t *volatile state; |
| 4401 | | | gboolean little_endian; |
| 4402 | | | int length_remaining; |
| 4403 | | | const char *volatile sep = NULL; |
| 4404 | | | |
| 4405 | | | |
| 4406 | | | |
| 4407 | | | |
| 4408 | | | |
| 4409 | | | |
| 4410 | | | |
| 4411 | | | conversation = find_conversation(pinfo->fd->num, &pinfo->src, &pinfo->dst, |
| 4412 | [+] | | pinfo->ptype, pinfo->srcport, pinfo->destport, 0); |
 |
| 4413 | | | if (conversation == NULL) { |
Event 8:
Skipping " if". conversation == (void *)0 evaluates to false.
hide
|
|
| 4414 | | | |
| 4415 | | | |
| 4416 | | | |
| 4417 | | | conversation = conversation_new(pinfo->fd->num, &pinfo->src, &pinfo->dst, |
| 4418 | | | pinfo->ptype, pinfo->srcport, pinfo->destport, 0); |
| 4419 | | | } |
| 4420 | | | |
| 4421 | | | |
| 4422 | | | |
| 4423 | | | |
| 4424 | [+] | | if ((state = conversation_get_proto_data(conversation, proto_x11)) |
 |
| 4425 | | | == NULL) { |
Event 13:
Skipping " if". (state = conversation_get_proto_data(...)) == (void *)0 evaluates to false.
hide
|
|
| 4426 | | | |
| 4427 | | | |
| 4428 | | | |
| 4429 | | | state = x11_stateinit(conversation); |
| 4430 | | | } |
| 4431 | | | |
| 4432 | | | |
| 4433 | | | |
| 4434 | | | |
| 4435 | | | little_endian = guess_byte_ordering(tvb, pinfo, state); |
| 4436 | | | |
| 4437 | | | offset = 0; |
| 4438 | [+] | | while (tvb_reported_length_remaining(tvb, offset) != 0) { |
 |
| 4439 | | | |
| 4440 | | | |
| 4441 | | | |
| 4442 | | | |
| 4443 | | | |
| 4444 | | | |
| 4445 | | | |
| 4446 | | | length_remaining = tvb_ensure_length_remaining(tvb, offset); |
| 4447 | | | |
| 4448 | | | |
| 4449 | | | |
| 4450 | | | |
| 4451 | | | if (x11_desegment && pinfo->can_desegment) { |
Event 18:
Skipping " if". x11_desegment evaluates to false.
hide
|
|
| 4452 | | | |
| 4453 | | | |
| 4454 | | | |
| 4455 | | | |
| 4456 | | | if (length_remaining < 8) { |
| 4457 | | | |
| 4458 | | | |
| 4459 | | | |
| 4460 | | | |
| 4461 | | | |
| 4462 | | | |
| 4463 | | | pinfo->desegment_offset = offset; |
| 4464 | | | pinfo->desegment_len = 8 - length_remaining; |
| 4465 | | | return; |
| 4466 | | | } |
| 4467 | | | } |
| 4468 | | | |
| 4469 | | | |
| 4470 | | | |
| 4471 | | | |
| 4472 | | | |
| 4473 | | | |
| 4474 | | | |
| 4475 | | | |
| 4476 | | | |
| 4477 | | | if (g_hash_table_lookup(state->seqtable, |
| 4478 | | | GINT_TO_POINTER(state->sequencenumber)) == (int *)INITIAL_CONN |
Null Pointer Dereference
state is dereferenced here, but it is NULL. The issue can occur if the highlighted code executes. See related event 12. Show: All events | Only primary events |
|
| |