(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-cops.c) |
| |
| 1381 | | | static int dissect_cops_pr_object_data(tvbuff_t *tvb, packet_info *pinfo, guint32 offset, proto_tree *tree, |
| 1382 | | | guint8 s_num, guint8 s_type, int len, |
| 1383 | | | oid_info_t** oid_info_p, guint32** pprid_subids, guint* pprid_subids_len) { |
| 1384 | | | proto_item *ti; |
| 1385 | | | proto_tree *asn_tree, *gperror_tree, *cperror_tree; |
| 1386 | | | guint16 gperror=0, gperror_sub=0, cperror=0, cperror_sub=0; |
| 1387 | | | asn1_ctx_t actx; |
| 1388 | | | |
| 1389 | | | memset(&actx,0,sizeof(actx)); |
| 1390 | | | actx.pinfo = pinfo; |
| 1391 | | | |
| 1392 | | | switch (s_num){ |
Event 1:
s_num evaluates to 3.
hide
|
|
| 1393 | | | case COPS_OBJ_PPRID: { |
| 1394 | | | tvbuff_t* oid_tvb = NULL; |
| 1395 | | | |
| 1396 | | | if (s_type != 1) |
| 1397 | | | break; |
| 1398 | | | |
| 1399 | | | ti = proto_tree_add_text(tree, tvb, offset, len, "Contents:"); |
| 1400 | | | asn_tree = proto_item_add_subtree(ti, ett_cops_asn1); |
| 1401 | | | |
| 1402 | | | offset = dissect_ber_object_identifier(FALSE, &actx, asn_tree, tvb, offset, hf_cops_pprid_oid, &oid_tvb); |
| 1403 1451 |  | | [ Lines 1403 to 1451 omitted. ] |
| 1452 | | | |
| 1453 | | | |
| 1454 | | | if (left <= 1 && oid_info->kind == OID_KIND_ROW) { |
| 1455 | | | *oid_info_p = oid_info; |
| 1456 | | | } else { |
| 1457 | | | *oid_info_p = NULL; |
| 1458 | | | } |
| 1459 | | | |
| 1460 | | | break; |
| 1461 | | | } |
| 1462 | | | case COPS_OBJ_EPD: { |
| 1463 | | | oid_info_t* oid_info; |
| 1464 | | | guint end_offset = offset + len; |
| 1465 | | | |
| 1466 | | | if (s_type != 1) break; |
Event 2:
Skipping " if". s_type != 1 evaluates to false.
hide
|
|
| 1467 | | | |
| 1468 | | | ti = proto_tree_add_text(tree, tvb, offset, len, "Contents:"); |
| 1469 | | | asn_tree = proto_item_add_subtree(ti, ett_cops_asn1); |
| 1470 | | | |
| 1471 | | | |
| 1472 | | | |
| 1473 | | | |
| 1474 | | | |
| 1475 | | | |
| 1476 | | | |
| 1477 | | | |
| 1478 | | | |
| 1479 | | | |
| 1480 | | | if(*oid_info_p) { |
Event 3:
Taking false branch. *oid_info_p evaluates to false.
hide
Event 4:
Considering the case where *oid_info_p must have been equal to 0.
hide
|
|
| 1481 | | | if ((*oid_info_p)->kind == OID_KIND_ROW) { |
| 1482 | | | oid_info = emem_tree_lookup32((*oid_info_p)->children,1); |
| 1483 | | | } else { |
| 1484 | | | oid_info = NULL; |
| 1485 | | | } |
| 1486 | | | } else { |
| 1487 | | | oid_info = NULL; |
| 1488 | | | } |
| 1489 | | | |
| 1490 | | | |
| 1491 | | | while(offset < end_offset) { |
Event 6:
Continuing from loop body. Entering loop body. offset < end_offset evaluates to true.
hide
|
|
| 1492 | | | gint8 ber_class; |
| 1493 | | | gboolean ber_pc; |
| 1494 | | | gint32 ber_tag; |
| 1495 | | | guint32 ber_length; |
| 1496 | | | gboolean ber_ind; |
| 1497 | | | |
| 1498 | | | offset = get_ber_identifier(tvb, offset, &ber_class, &ber_pc, &ber_tag); |
| 1499 | | | offset = get_ber_length(tvb, offset, &ber_length, &ber_ind); |
| 1500 | | | |
| 1501 | | | if (oid_info) { |
Event 7:
Taking true branch. oid_info evaluates to true.
hide
|
|
| 1502 | | | |
| 1503 | | | |
| 1504 | | | |
| 1505 | | | |
| 1506 | | | |
| 1507 | | | |
| 1508 | | | |
| 1509 | | | |
| 1510 | | | |
| 1511 | | | |
| 1512 | | | |
| 1513 | | | |
| 1514 | | | proto_tree_add_item(asn_tree,oid_info->value_hfid,tvb,offset,ber_length,FALSE); |
| 1515 | | | |
| 1516 | | | oid_info = emem_tree_lookup32((*oid_info_p)->children,oid_info->subid+1); |
Null Pointer Dereference
*oid_info_p is dereferenced here, but it is NULL. - *oid_info_p is equal to 0.
The issue can occur if the highlighted code executes. See related event 4. Show: All events | Only primary events |
|
| 1517 | | | } else { |
| 1518 | | | int hfid = cops_tag_cls2syntax( ber_tag, ber_class ); |
| 1519 | | | proto_tree_add_item(asn_tree,hfid,tvb,offset,ber_length,FALSE); |
| 1520 | | | } |
| 1521 | | | |
| 1522 | | | offset += ber_length; |
| |