(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-ncp-nmas.c) |
| |
| 284 | | | dissect_nmas_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ncp_tree, ncp_req_hash_value *request_value) |
| 285 | | | { |
| 286 | | | guint8 func, subfunc = 0; |
| 287 | | | guint32 msg_length=0, cur_string_len=0; |
| 288 | | | guint32 foffset; |
| 289 | | | guint32 subverb=0; |
| 290 | | | guint32 attribute=0; |
| 291 | | | guint8 msgverb=0; |
| 292 | | | proto_tree *atree; |
| 293 | | | proto_item *aitem; |
| 294 | | | |
| 295 | | | foffset = 6; |
| 296 | | | func = tvb_get_guint8(tvb, foffset); |
| 297 | | | foffset += 1; |
| 298 | | | subfunc = tvb_get_guint8(tvb, foffset); |
| 299 | | | foffset += 1; |
| 300 | | | |
| 301 | | | |
| 302 | | | if (check_col(pinfo->cinfo, COL_PROTOCOL)) { |
Event 1:
Skipping " if". check_col(...) evaluates to false.
hide
|
|
| 303 | | | col_set_str(pinfo->cinfo, COL_PROTOCOL, "NMAS"); |
| 304 | | | } |
| 305 | | | if (check_col(pinfo->cinfo, COL_INFO)) { |
Event 2:
Skipping " if". check_col(...) evaluates to false.
hide
|
|
| 306 | | | col_add_fstr(pinfo->cinfo, COL_INFO, "C NMAS - %s", |
| 307 | | | val_to_str(subfunc, nmas_func_enum, "Unknown (0x%02x)")); |
| 308 | | | } |
| 309 | | | aitem = proto_tree_add_text(ncp_tree, tvb, foffset, -1, "Packet Type: %s", |
| 310 | | | val_to_str(subfunc, nmas_func_enum, "Unknown (0x%02x)")); |
| 311 | | | atree = proto_item_add_subtree(aitem, ett_nmas); |
| 312 | | | switch (subfunc) { |
Event 3:
subfunc evaluates to 2.
hide
|
|
| 313 | | | case 1: |
| 314 | | | proto_tree_add_item(atree, hf_ping_version, tvb, foffset, 4, TRUE); |
| 315 | | | foffset += 4; |
| 316 | | | proto_tree_add_item(atree, hf_ping_flags, tvb, foffset, 4, TRUE); |
| 317 | | | foffset += 4; |
| 318 | | | break; |
| 319 | | | case 2: |
| 320 | | | proto_tree_add_item(atree, hf_frag_handle, tvb, foffset, 4, TRUE); |
Event 4:
!0 evaluates to true.
hide
|
|
| 321 | | | |
| 322 | | | if (tvb_get_letohl(tvb, foffset)!=0xffffffff) { |
Event 5:
Skipping " if". tvb_get_letohl(...) != 4294967295 evaluates to false.
hide
|
|
| 323 | | | break; |
| 324 | | | } |
| 325 | | | foffset += 4; |
| 326 | | | foffset += 4; |
| 327 | | | proto_tree_add_item(atree, hf_length, tvb, foffset, 4, TRUE); |
Event 6:
!0 evaluates to true.
hide
|
|
| 328 | | | msg_length = tvb_get_letohl(tvb, foffset); |
| 329 | | | foffset += 4; |
| 330 | | | foffset += 12; |
| 331 | | | msg_length -= 16; |
| 332 | | | proto_tree_add_item(atree, hf_subverb, tvb, foffset, 4, TRUE); |
Event 7:
!0 evaluates to true.
hide
|
|
| 333 | | | subverb = tvb_get_letohl(tvb, foffset); |
| 334 | | | if (request_value) { |
Event 8:
Taking true branch. request_value evaluates to true.
hide
|
|
| 335 | | | request_value->req_nds_flags=subverb; |
| 336 | | | } |
| 337 | | | foffset += 4; |
| 338 | | | msg_length -= 4; |
| 339 | | | if (check_col(pinfo->cinfo, COL_INFO)) { |
Event 10:
Skipping " if". check_col(...) evaluates to false.
hide
|
|
| 340 | | | col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", |
| 341 | | | val_to_str(subverb, nmas_subverb_enum, "Unknown subverb (%u)")); |
| 342 | | | } |
| 343 | | | switch (subverb) { |
Event 11:
subverb evaluates to 8.
hide
|
|
| 344 | | | case 0: |
| 345 | | | proto_tree_add_item(atree, hf_ping_version, tvb, foffset, 4, TRUE); |
| 346 | | | foffset += 4; |
| 347 | | | proto_tree_add_item(atree, hf_ping_flags, tvb, foffset, 4, TRUE); |
| 348 | | | foffset += 4; |
| 349 | | | break; |
| 350 | | | case 2: |
| 351 | | | proto_tree_add_item(atree, hf_opaque, tvb, foffset, msg_length, FALSE); |
| 352 | | | foffset += msg_length; |
| 353 | | | break; |
| 354 | | | case 4: |
| 355 | | | case 6: |
| 356 | | | |
| 357 | | | break; |
| 358 | | | case 8: |
| 359 | | | proto_tree_add_item(atree, hf_reply_buffer_size, tvb, foffset, 1, TRUE); |
Event 12:
!0 evaluates to true.
hide
|
|
| 360 | | | foffset += 4; |
| 361 | | | msgverb = tvb_get_guint8(tvb, foffset); |
| 362 | | | if (request_value) { |
Null Test After Dereference
This code tests the nullness of request_value, which has already been dereferenced. - If request_value were null, there would have been a prior null pointer dereference at packet-ncp-nmas.c:335, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 9. Show: All events | Only primary events |
|
| 363 | | | request_value->nds_request_verb=msgverb; |
| 364 | | | } |
| 365 | | | proto_tree_add_item(atree, hf_lsm_verb, tvb, foffset, 1, TRUE); |
| 366 | | | foffset += 4; |
| 367 | | | if (check_col(pinfo->cinfo, COL_INFO)) { |
| 368 | | | col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", |
| 369 | | | val_to_str(msgverb, nmas_lsmverb_enum, "Unknown (%u)")); |
| 370 | | | } |
| 371 | | | switch (msgverb) |
| 372 | | | { |
| 373 | | | case 1: |
| 374 | | | break; |
| 375 | | | case 2: |
| 376 | | | break; |
| 377 | | | case 4: |
| 378 | | | break; |
| 379 | | | case 5: |
| 380 | | | break; |
| 381 | | | case 6: |
| 382 | | | break; |
| 383 | | | default: |
| 384 | | | break; |
| 385 | | | } |
| 386 | | | break; |
| 387 | | | case 10: |
| 388 | | | |
| 389 | | | foffset += 4; |
| 390 | | | |
| 391 | | | foffset += 8; |
| 392 | | | foffset = nmas_string(tvb, hf_tree, atree, foffset, TRUE); |
| 393 | | | foffset = nmas_string(tvb, hf_user, atree, foffset, TRUE); |
| 394 | | | break; |
| 395 | | | case 1242: |
| 396 | | | foffset += 4; |
| 397 | | | proto_tree_add_item(atree, hf_msg_version, tvb, foffset, 4, FALSE); |
| 398 | | | foffset += 4; |
| 399 | | | proto_tree_add_item(atree, hf_session_ident, tvb, foffset, 4, FALSE); |
| 400 | | | foffset += 4; |
| 401 | | | foffset += 3; |
| 402 | | | msgverb = tvb_get_guint8(tvb, foffset); |
| 403 | | | if (request_value) { |
| 404 | | | request_value->nds_request_verb=msgverb; |
| 405 | | | } |
| 406 | | | proto_tree_add_item(atree, hf_msg_verb, tvb, foffset, 1, FALSE); |
| 407 | | | foffset += 1; |
| 408 | | | msg_length -= 12; |
| 409 | | | if (check_col(pinfo->cinfo, COL_INFO)) { |
| 410 | | | col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", |
| 411 | | | val_to_str(msgverb, nmas_msgverb_enum, "Unknown (%u)")); |
| 412 | | | } |
| 413 | | | switch(msgverb) |
| 414 | | | { |
| 415 | | | case 1: |
| 416 | | | msg_length = tvb_get_ntohl(tvb, foffset); |
| 417 | | | proto_tree_add_item(atree, hf_length, tvb, foffset, 4, FALSE); |
| 418 | | | foffset += 4; |
| 419 | | | proto_tree_add_item(atree, hf_data, tvb, foffset, msg_length, FALSE); |
| 420 | | | foffset += msg_length; |
| 421 | | | break; |
| 422 | | | case 3: |
| 423 | | | msg_length = tvb_get_ntohl(tvb, foffset); |
| 424 | | | msg_length -= 4; |
| 425 | | | proto_tree_add_item(atree, hf_length, tvb, foffset, 4, FALSE); |
| 426 | | | foffset += 4; |
| 427 | | | while (msg_length > 0) |
| 428 | | | { |
| 429 | | | attribute = tvb_get_ntohl(tvb, foffset); |
| 430 | | | foffset += 4; |
| 431 | | | cur_string_len=tvb_get_ntohl(tvb, foffset); |
| 432 | | | switch (attribute) { |
| 433 | | | case 1: |
| 434 | | | foffset = nmas_string(tvb, hf_user, atree, foffset, FALSE); |
| 435 | | | break; |
| 436 | | | case 2: |
| 437 | | | foffset = nmas_string(tvb, hf_tree, atree, foffset, FALSE); |
| 438 | | | break; |
| 439 | | | case 4: |
| 440 | | | foffset = nmas_string(tvb, hf_clearance, atree, foffset, FALSE); |
| 441 | | | break; |
| 442 | | | case 11: |
| 443 | | | foffset = nmas_string(tvb, hf_login_sequence, atree, foffset, FALSE); |
| 444 | | | break; |
| 445 | | | default: |
| 446 | | | break; |
| 447 | | | } |
| 448 | | | msg_length -= cur_string_len; |
| 449 | | | if (tvb_reported_length_remaining(tvb, foffset)<5) |
| 450 | | | { |
| 451 | | | break; |
| 452 | | | } |
| 453 | | | } |
| 454 | | | break; |
| 455 | | | case 5: |
| 456 | | | proto_tree_add_item(atree, hf_opaque, tvb, foffset, tvb_reported_length_remaining(tvb, foffset), FALSE); |
| 457 | | | foffset += msg_length; |
| 458 | | | break; |
| 459 | | | case 7: |
| 460 | | | case 9: |
| 461 | | | |
| 462 | | | break; |
| 463 | | | default: |
| 464 | | | break; |
| 465 | | | } |
| 466 | | | break; |
| 467 | | | default: |
| 468 | | | break; |
| 469 | | | } |
| 470 | | | break; |
| 471 | | | case 3: |
| 472 | | | |
| 473 | | | break; |
| 474 | | | default: |
| 475 | | | break; |
| 476 | | | } |
| 477 | | | } |
| |