(/home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/mate/mate_util.c) |
| |
| 1025 | | | extern AVPL* new_avpl_loose_match(const gchar* name, |
| 1026 | | | AVPL* src, |
| 1027 | | | AVPL* op, |
| 1028 | | | gboolean copy_avps) { |
| 1029 | | | |
| 1030 | | | AVPL* newavpl = new_avpl(scs_subscribe(avp_strings, name)); |
| 1031 | | | AVPN* co = NULL; |
| 1032 | | | AVPN* cs = NULL; |
| 1033 | | | ptrdiff_t c; |
| 1034 | | | AVP* m; |
| 1035 | | | AVP* copy; |
| 1036 | | | |
| 1037 | | | #ifdef _AVP_DEBUGGING |
| 1038 | | | dbg_print(dbg_avpl_op,3,dbg_fp,"new_avpl_loose_match: %X src=%X op=%X name='%s'",newavpl,src,op,name); |
| 1039 | | | #endif |
| 1040 | | | |
| 1041 | | | |
| 1042 | | | cs = src->null.next; |
Event 1:
cs is set to src->null.next.
hide
|
|
| 1043 | | | co = op->null.next; |
| 1044 | | | while(1) { |
Event 2:
Entering loop body. 1 evaluates to true.
hide
|
|
| 1045 | | | |
| 1046 | | | if (!co->avp) { |
Event 3:
Skipping " if". co->avp evaluates to true.
hide
|
|
| 1047 | | | return newavpl; |
| 1048 | | | } |
| 1049 | | | |
| 1050 | | | if (!cs->avp) { |
Event 4:
Skipping " if". cs->avp evaluates to true.
hide
|
|
| 1051 | | | return newavpl; |
| 1052 | | | } |
| 1053 | | | |
| 1054 | | | |
| 1055 | | | c = ADDRDIFF(co->avp->n, cs->avp->n);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/mate/mate_util.c |
| |
39 | #define ADDRDIFF(p,q) (((char *)(void *)(p)) - ((char *)(void *)(q))) |
| |
|
Event 5:
*cs is dereferenced, where cs is src->null.next. See related event 1.
hide
|
|
| 1056 | | | |
| 1057 | | | if ( c > 0 ) { |
Event 6:
Taking false branch. c > 0 evaluates to false.
hide
|
|
| 1058 | | | if (co->avp) co = co->next; |
| 1059 | | | } else if (c < 0) { |
Event 7:
Taking false branch. c < 0 evaluates to false.
hide
|
|
| 1060 | | | if (cs->avp) cs = cs->next; |
| 1061 | | | } else { |
| 1062 | | | m = match_avp(cs->avp,co->avp); |
| 1063 | | | if(m) { |
Event 8:
Skipping " if". m evaluates to false.
hide
|
|
| 1064 | | | |
| 1065 | | | if (copy_avps) { |
| 1066 | | | copy = avp_copy(m); |
| 1067 | | | if ( ! insert_avp(newavpl,copy) ) { |
| 1068 | | | delete_avp(copy); |
| 1069 | | | } |
| 1070 | | | } else { |
| 1071 | | | insert_avp(newavpl,m); |
| 1072 | | | } |
| 1073 | | | |
| 1074 | | | |
| 1075 | | | } |
| 1076 | | | |
| 1077 | | | if (cs->avp) cs = cs->next; |
Null Test After Dereference
This code tests the nullness of *cs, which has already been dereferenced. - If *cs were null, there would have been a prior null pointer dereference at mate_util.c:1055, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related events 1 and 5. Show: All events | Only primary events |
|
| 1078 | | | |
| 1079 | | | } |
| 1080 | | | } |
| 1081 | | | |
| 1082 | | | #ifdef _AVP_DEBUGGING |
| 1083 | | | dbg_print(dbg_avpl_op,6,dbg_fp,"new_avpl_loose_match: done!"); |
| 1084 | | | #endif |
| 1085 | | | |
| 1086 | | | return NULL; |
| 1087 | | | } |
| |