(/home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/profinet/packet-dcom-cba-acco.c) |
| |
| 2489 | | | dissect_ICBAAccoServerSRT_Connect_rqst(tvbuff_t *tvb, int offset, |
| 2490 | | | packet_info *pinfo, proto_tree *tree, guint8 *drep) |
| 2491 | | | { |
| 2492 | | | guint32 u32ProvCRID; |
| 2493 | | | guint8 u8State; |
| 2494 | | | guint8 u8LastConnect; |
| 2495 | | | guint32 u32Count; |
| 2496 | | | guint32 u32ArraySize; |
| 2497 | | | guint32 u32VariableOffset; |
| 2498 | | | guint32 u32Idx; |
| 2499 | | | proto_item *sub_item; |
| 2500 | | | proto_tree *sub_tree; |
| 2501 | | | guint32 u32SubStart; |
| 2502 | | | guint32 u32Pointer; |
| 2503 | | | gchar szProvItem[1000] = { 0 }; |
| 2504 | | | guint32 u32MaxProvItemLen = sizeof(szProvItem); |
| 2505 | | | guint16 u16TypeDescLen; |
| 2506 | | | guint32 u32ArraySize2; |
| 2507 | | | guint32 u32Idx2; |
| 2508 | | | guint16 u16VarType2 = -1; |
| 2509 | | | guint16 u16VarType; |
| 2510 | | | guint32 u32ConsID; |
| 2511 | | | guint16 u16RecordLength; |
| 2512 | | | proto_item *item; |
| 2513 | | | dcerpc_info *info = (dcerpc_info *)pinfo->private_data; |
| 2514 | | | cba_ldev_t *prov_ldev; |
| 2515 | | | cba_frame_t *frame = NULL; |
| 2516 | | | cba_connection_t *conn; |
| 2517 | | | guint16 typedesclen = 0; |
| 2518 | | | guint16 *typedesc = NULL; |
| 2519 | | | server_connect_call_t *call; |
| 2520 | | | |
| 2521 | | | |
| 2522 | | | offset = dissect_dcom_this(tvb, offset, pinfo, tree, drep); |
| 2523 | | | |
| 2524 | | | |
| 2525 | | | prov_ldev = cba_ldev_find(pinfo, pinfo->net_dst.data, &info->call_data->object_uuid); |
| 2526 | | | |
| 2527 | | | item = proto_tree_add_boolean (tree, hf_cba_acco_srt_call, tvb, offset, 0, TRUE); |
Event 1:
!0 evaluates to true.
hide
|
|
| 2528 | | | PROTO_ITEM_SET_GENERATED(item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
325 | #define PROTO_ITEM_SET_GENERATED(proto_item) \ |
326 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_GENERATED) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
Event 2:
item evaluates to false.
hide
|
|
| 2529 | | | pinfo->profinet_type = 4; |
| 2530 | | | |
| 2531 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, drep, |
| 2532 | | | hf_cba_acco_prov_crid, &u32ProvCRID); |
| 2533 | | | |
| 2534 | [+] | | frame = cba_frame_find_by_provcrid(pinfo, prov_ldev, u32ProvCRID); |
 |
| 2535 | | | |
| 2536 | | | if(frame != NULL) { |
Event 8:
Skipping " if". frame != (void *)0 evaluates to false.
hide
|
|
| 2537 | | | cba_frame_info(tvb, pinfo, tree, frame); |
| 2538 | | | } |
| 2539 | | | |
| 2540 | | | offset = dissect_dcom_BYTE(tvb, offset, pinfo, tree, drep, |
| 2541 | | | hf_cba_acco_conn_state, &u8State); |
| 2542 | | | |
| 2543 | | | offset = dissect_dcom_BYTE(tvb, offset, pinfo, tree, drep, |
| 2544 | | | hf_cba_acco_serversrt_last_connect, &u8LastConnect); |
| 2545 | | | |
| 2546 | | | |
| 2547 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, drep, |
| 2548 | | | hf_cba_acco_count, &u32Count); |
| 2549 | | | |
| 2550 | | | offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, drep, |
| 2551 | [+] | | &u32ArraySize); |
Event 9:
dissect_dcom_dcerpc_array_size() does not initialize u32ArraySize. - This may be because of a failure case or other special case for dissect_dcom_dcerpc_array_size().
hide
|
|
 |
| 2552 | | | |
| 2553 | | | |
| 2554 | | | if(frame != NULL) { |
Event 13:
Taking false branch. frame != (void *)0 evaluates to false.
hide
|
|
| 2555 | | | call = se_alloc(sizeof(server_connect_call_t) + u32ArraySize * sizeof(cba_connection_t *)); |
| 2556 | | | call->conn_count = 0; |
| 2557 | | | call->frame = frame; |
| 2558 | | | call->conns = (cba_connection_t **) (call+1); |
| 2559 | | | info->call_data->private_data = call; |
| 2560 | | | } else{ |
| 2561 | | | call = NULL; |
| 2562 | | | } |
| 2563 | | | |
| 2564 | | | u32VariableOffset = offset + u32ArraySize*20; |
Uninitialized Variable
u32ArraySize was not initialized. The issue can occur if the highlighted code executes. See related events 9 and 11. Show: All events | Only primary events |
|
| |