(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dnp.c) |
| |
| 1294 | | | dnp3_al_process_object(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *robj_tree, gboolean , guint16 *al_objtype) |
| 1295 | | | { |
| 1296 | | | |
| 1297 | | | guint8 al_2bit, al_objq, al_objq_index, al_objq_code, al_ptflags, al_ctlobj_code, al_oct_len=0, |
| 1298 | | | al_ctlobj_code_c, al_ctlobj_code_m, al_ctlobj_code_tc, al_ctlobj_count, al_bi_val, bitindex=0; |
| 1299 | | | guint16 al_obj, al_val16=0, al_ctlobj_stat, al_relms; |
| 1300 | | | guint32 al_val32, al_ptaddr=0, al_ctlobj_on, al_ctlobj_off; |
| 1301 | | | nstime_t al_cto, al_reltime, al_abstime; |
| 1302 | | | gboolean al_bit; |
| 1303 | | | guint data_pos; |
| 1304 | | | gfloat al_valflt; |
| 1305 | | | gdouble al_valdbl; |
| 1306 | | | int item_num, num_items=0; |
| 1307 | | | int orig_offset, start_offset, rangebytes=0, indexbytes=0; |
| 1308 | | | proto_item *object_item = NULL, *point_item = NULL, *qualifier_item = NULL, *range_item = NULL; |
| 1309 | | | proto_tree *object_tree = NULL, *point_tree, *qualifier_tree, *range_tree; |
| 1310 | | | const gchar *ctl_code_str, *ctl_misc_str, *ctl_tc_str, *ctl_status_str; |
| 1311 | | | |
| 1312 | | | orig_offset = offset; |
| 1313 | | | |
| 1314 | | | |
| 1315 | | | *al_objtype = |
| 1316 | [+] | | al_obj = tvb_get_ntohs(tvb, offset); |
 |
| 1317 | | | |
| 1318 | | | |
| 1319 | | | if ((al_obj & 0xFF00) == AL_OBJ_OCT) { |
Event 1:
Skipping " if". (al_obj & 65280) == 28160 evaluates to false.
hide
|
|
| 1320 | | | al_oct_len = al_obj & 0xFF; |
| 1321 | | | al_obj = AL_OBJ_OCT; |
| 1322 | | | } |
| 1323 | | | |
| 1324 | | | |
| 1325 | | | object_item = proto_tree_add_uint_format(robj_tree, hf_dnp3_al_obj, tvb, offset, 2, al_obj, |
| 1326 | | | "Object(s): %s (0x%04x)", val_to_str(al_obj, dnp3_al_obj_vals, "Unknown Object - Abort Decoding..."), al_obj); |
| 1327 | | | object_tree = proto_item_add_subtree(object_item, ett_dnp3_al_obj); |
| 1328 | | | |
| 1329 | | | offset += 2; |
| 1330 | | | |
| 1331 | | | |
| 1332 | | | al_objq = tvb_get_guint8(tvb, offset); |
| 1333 | | | al_objq_index = al_objq & AL_OBJQ_INDEX; |
| 1334 | | | al_objq_index = al_objq_index >> 4; |
| 1335 | | | al_objq_code = al_objq & AL_OBJQ_CODE; |
| 1336 | | | |
| 1337 | | | qualifier_item = proto_tree_add_text(object_tree, tvb, offset, 1, "Qualifier Field, Prefix: %s, Code: %s", |
| 1338 | | | val_to_str(al_objq_index, dnp3_al_objq_index_vals, "Unknown Index Type"), |
| 1339 | | | val_to_str(al_objq_code, dnp3_al_objq_code_vals, "Unknown Code Type")); |
| 1340 | | | qualifier_tree = proto_item_add_subtree(qualifier_item, ett_dnp3_al_obj_qualifier); |
| 1341 | | | proto_tree_add_item(qualifier_tree, hf_dnp3_al_objq_index, tvb, offset, 1, FALSE); |
| 1342 | | | proto_tree_add_item(qualifier_tree, hf_dnp3_al_objq_code, tvb, offset, 1, FALSE); |
| 1343 | | | |
| 1344 | | | offset += 1; |
| 1345 | | | |
| 1346 | | | |
| 1347 | | | range_item = proto_tree_add_text(object_tree, tvb, offset, 0, "Number of Items: "); |
| 1348 | | | range_tree = proto_item_add_subtree(range_item, ett_dnp3_al_obj_range); |
| 1349 | | | |
| 1350 | | | switch (al_objq_code) |
Event 2:
al_objq_code evaluates to 0.
hide
|
|
| 1351 | | | { |
| 1352 | | | case AL_OBJQL_CODE_SSI8:
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dnp.c |
| |
221 | #define AL_OBJQL_CODE_SSI8 0x00 /* 00 8-bit Start and Stop Indices in Range Field */ |
| |
|
| 1353 | | | num_items = ( tvb_get_guint8(tvb, offset+1) - tvb_get_guint8(tvb, offset) + 1); |
| 1354 | | | PROTO_ITEM_SET_GENERATED(range_item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
325 | #define PROTO_ITEM_SET_GENERATED(proto_item) \ |
326 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_GENERATED) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
Event 3:
range_item evaluates to true.
hide
|
|
| 1355 | | | al_ptaddr = tvb_get_guint8(tvb, offset); |
| 1356 | | | proto_tree_add_item(range_tree, hf_dnp3_al_range_start8, tvb, offset, 1, TRUE); |
Event 4:
!0 evaluates to true.
hide
|
|
| 1357 | | | proto_tree_add_item(range_tree, hf_dnp3_al_range_stop8, tvb, offset + 1, 1, TRUE); |
Event 5:
!0 evaluates to true.
hide
|
|
| 1358 | | | rangebytes = 2; |
| 1359 | | | break; |
| 1360 | | | case AL_OBJQL_CODE_SSI16:
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dnp.c |
| |
222 | #define AL_OBJQL_CODE_SSI16 0x01 /* 01 16-bit Start and Stop Indices in Range Field */ |
| |
|
| 1361 | | | num_items = ( tvb_get_letohs(tvb, offset+2) - tvb_get_letohs(tvb, (offset)) + 1); |
| 1362 | | | PROTO_ITEM_SET_GENERATED(range_item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
325 | #define PROTO_ITEM_SET_GENERATED(proto_item) \ |
326 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_GENERATED) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
| 1363 | | | al_ptaddr = tvb_get_letohs(tvb, offset); |
| 1364 | | | proto_tree_add_item(range_tree, hf_dnp3_al_range_start16, tvb, offset, 2, TRUE); |
| 1365 | | | proto_tree_add_item(range_tree, hf_dnp3_al_range_stop16, tvb, offset + 2, 2, TRUE); |
| 1366 | | | rangebytes = 4; |
| 1367 | | | break; |
| 1368 | | | case AL_OBJQL_CODE_SSI32:
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dnp.c |
| |
223 | #define AL_OBJQL_CODE_SSI32 0x02 /* 02 32-bit Start and Stop Indices in Range Field */ |
| |
|
| 1369 | | | num_items = ( tvb_get_letohl(tvb, offset+4) - tvb_get_letohl(tvb, offset) + 1); |
| 1370 1405 |  | | [ Lines 1370 to 1405 omitted. ] |
| 1406 | | | rangebytes = 2; |
| 1407 | | | proto_item_set_len(range_item, rangebytes); |
| 1408 | | | break; |
| 1409 | | | case AL_OBJQL_CODE_SF32: |
| 1410 | | | num_items = tvb_get_letohl(tvb, offset); |
| 1411 | | | proto_tree_add_item(range_tree, hf_dnp3_al_range_quant32, tvb, offset, 4, TRUE); |
| 1412 | | | rangebytes = 4; |
| 1413 | | | proto_item_set_len(range_item, rangebytes); |
| 1414 | | | break; |
| 1415 | | | } |
| 1416 | | | if (num_items > 0) { |
Event 6:
Taking true branch. num_items > 0 evaluates to true.
hide
|
|
| 1417 | | | proto_item_append_text(object_item, ", %d point%s", num_items, plurality(num_items, "", "s")); |
Event 7:
num_items == 1 evaluates to true.
hide
|
|
| 1418 | | | } |
| 1419 | | | proto_item_append_text(range_item, "%d", num_items); |
| 1420 | | | |
| 1421 | | | if (num_items < 0) { |
Event 8:
Skipping " if". num_items < 0 evaluates to false.
hide
|
|
| 1422 | | | proto_item_append_text(range_item, " (bogus)"); |
| 1423 | | | expert_add_info_format(pinfo, range_item, PI_MALFORMED, PI_ERROR, "Negative number of items"); |
| 1424 | | | return tvb_length(tvb); |
| 1425 | | | } |
| 1426 | | | |
| 1427 | | | |
| 1428 | | | offset += rangebytes; |
| 1429 | | | |
| 1430 | | | bitindex = 0; |
| 1431 | | | |
| 1432 | | | |
| 1433 | | | |
| 1434 | | | if (! || al_objq_index > 0) { |
Event 9:
Taking true branch. evaluates to false.
hide
|
|
| 1435 | | | start_offset = offset; |
| 1436 | | | for (item_num = 0; item_num < num_items; item_num++) |
Event 10:
Entering loop body. item_num < num_items evaluates to true.
hide
|
|
| 1437 | | | { |
| 1438 | | | |
| 1439 | | | point_item = proto_tree_add_text(object_tree, tvb, offset, 0, "Point Number"); |
| 1440 | | | point_tree = proto_item_add_subtree(point_item, ett_dnp3_al_obj_point); |
| 1441 | | | |
| 1442 | | | data_pos = offset; |
| 1443 | | | indexbytes = dnp3_al_obj_procindex(tvb, offset, al_objq_index, &al_ptaddr, point_tree); |
| 1444 | | | proto_item_append_text(point_item, " %u", al_ptaddr); |
| 1445 | | | data_pos += indexbytes; |
| 1446 | | | |
| 1447 | | | if (!) { |
Event 11:
Taking true branch. evaluates to false.
hide
|
|
| 1448 | | | switch (al_obj) |
Event 12:
al_obj evaluates to 515.
hide
|
|
| 1449 | | | { |
| 1450 | | | |
| 1451 | | | case AL_OBJ_BI_ALL:
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dnp.c |
| |
242 | #define AL_OBJ_BI_ALL 0x0100 /* 01 00 Binary Input Default Variation */ |
| |
|
| 1452 | | | case AL_OBJ_BIC_ALL:
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dnp.c |
| |
245 | #define AL_OBJ_BIC_ALL 0x0200 /* 02 00 Binary Input Change Default Variation */ |
| |
|
| 1453 | | | case AL_OBJ_2BI_ALL:
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dnp.c |
| |
251 | #define AL_OBJ_2BI_ALL 0x0300 /* 03 00 Double-bit Input Default Variation */ |
| |
|
| 1454 | | | case AL_OBJ_CTR_ALL:
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dnp.c |
| |
319 | #define AL_OBJ_CTR_ALL 0x1400 /* 20 00 Binary Counter Default Variation */ |
| |
|
| 1455 | | | case AL_OBJ_CTRC_ALL:
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dnp.c |
| |
341 | #define AL_OBJ_CTRC_ALL 0x1600 /* 22 00 Counter Change Event Default Variation */ |
| |
|
| 1456 | | | case AL_OBJ_AI_ALL:
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dnp.c |
| |
372 | #define AL_OBJ_AI_ALL 0x1E00 /* 30 00 Analog Input Default Variation */ |
| |
|
| 1457 | | | case AL_OBJ_AIC_ALL:
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dnp.c |
| |
387 | #define AL_OBJ_AIC_ALL 0x2000 /* 32 00 Analog Input Change Default Variation */ |
| |
|
| 1458 | | | |
| 1459 1583 |  | | [ Lines 1459 to 1583 omitted. ] |
| 1584 | | | proto_tree_add_time(point_tree, hf_dnp3_al_timestamp, tvb, data_pos, 6, &al_abstime); |
| 1585 | | | data_pos += 6; |
| 1586 | | | |
| 1587 | | | al_2bit = (al_ptflags >> 6) & 3; |
| 1588 | | | proto_item_append_text(point_item, ", Value: %u, Timestamp: %s", al_2bit, abs_time_to_str(&al_abstime)); |
| 1589 | | | proto_item_set_len(point_item, data_pos - offset); |
| 1590 | | | |
| 1591 | | | offset = data_pos; |
| 1592 | | | break; |
| 1593 | | | |
| 1594 | | | case AL_OBJ_BIC_RTIME:
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dnp.c |
| |
248 | #define AL_OBJ_BIC_RTIME 0x0203 /* 02 03 Binary Input Change With Relative Time */ |
| |
|
| 1595 | | | |
| 1596 | | | |
| 1597 | | | al_ptflags = tvb_get_guint8(tvb, data_pos); |
| 1598 | | | dnp3_al_obj_quality(tvb, data_pos, al_ptflags, point_tree, point_item, BIN_IN); |
| 1599 | | | data_pos += 1; |
| 1600 | | | |
| 1601 | | | |
| 1602 | | | al_relms = tvb_get_letohs(tvb, data_pos); |
| 1603 | | | al_reltime.secs = al_relms / 1000; |
| 1604 | | | al_reltime.nsecs = (al_relms % 1000) * 1000; |
| 1605 | | | |
| 1606 | [+] | | nstime_sum(&al_abstime, &al_cto, &al_reltime); |
Event 13:
&al_cto is passed to nstime_sum() as the second argument.
hide
Event 14:
nstime_sum() does not initialize al_cto. - This may be because of a failure case or other special case for nstime_sum().
hide
|
|
 |
| |