(/home/sate/Testcases/c/cve/wireshark-1.2.0/dumpcap.c) |
| |
| 825 | | | cap_pipe_open_live(char *pipename, struct pcap_hdr *hdr, loop_data *ld, |
| 826 | | | char *errmsg, int errmsgl) |
| 827 | | | { |
| 828 | | | #ifndef _WIN32 |
| 829 | | | struct stat pipe_stat; |
| 830 | | | #else |
| 831 | | | char *pncopy, *pos; |
| 832 | | | guint32 pre_read_word; |
| 833 | | | wchar_t *err_str; |
| 834 | | | HANDLE hPipe = NULL; |
| 835 | | | #endif |
| 836 | | | int sel_ret; |
| 837 | | | int fd; |
| 838 | | | int b; |
| 839 | | | guint32 magic; |
| 840 | | | unsigned int bytes_read; |
| 841 | | | |
| 842 | | | g_log(LOG_DOMAIN_CAPTURE_CHILD, G_LOG_LEVEL_DEBUG, "cap_pipe_open_live: %s", pipename);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/log.h |
| |
32 | #define LOG_DOMAIN_CAPTURE_CHILD "CaptureChild" |
| |
|
| 843 | | | |
| 844 | | | |
| 845 | | | |
| 846 | | | |
| 847 | | | if (strcmp(pipename, "-") == 0) { |
Event 2:
Taking false branch. strcmp(pipename, "-") == 0 evaluates to false.
hide
|
|
| 848 | | | fd = 0; |
| 849 | | | #ifdef _WIN32 |
| 850 | | | |
| 851 | | | |
| 852 | | | |
| 853 | | | |
| 854 | | | _setmode(0, _O_BINARY); |
| 855 | | | #endif |
| 856 | | | } else { |
| 857 | | | #ifndef _WIN32 |
| 858 | | | if (ws_stat(pipename, &pipe_stat) < 0) { |
Event 3:
pipename is passed to stat() as the first argument.
hide
Event 4:
stat() accesses the file named pipename. - The same name is used to access a file later, but it is not safe to assume that it will be the same underlying file.
See related event 3.
hide
Event 5:
Skipping " if". stat(pipename, &pipe_stat) < 0 evaluates to false.
hide
|
|
| 859 | | | if (errno == ENOENT || errno == ENOTDIR)
x /usr/include/asm-generic/errno-base.h |
| |
5 | #define ENOENT 2 /* No such file or directory */ |
| |
x /usr/include/asm-generic/errno-base.h |
| |
23 | #define ENOTDIR 20 /* Not a directory */ |
| |
|
| 860 | | | ld->cap_pipe_err = PIPNEXIST; |
| 861 | | | else { |
| 862 | | | g_snprintf(errmsg, errmsgl, |
| 863 | | | "The capture session could not be initiated " |
| 864 | | | "due to error on pipe: %s", strerror(errno)); |
| 865 | | | ld->cap_pipe_err = PIPERR; |
| 866 | | | } |
| 867 | | | return -1; |
| 868 | | | } |
| 869 | | | if (! S_ISFIFO(pipe_stat.st_mode)) {
x /usr/include/sys/stat.h |
| |
136 | # define S_ISFIFO(mode) __S_ISTYPE((mode), __S_IFIFO) |
| |
x /usr/include/sys/stat.h |
| |
129 | #define __S_ISTYPE(mode, mask) (((mode) & __S_IFMT) == (mask)) |
| |
x /usr/include/bits/stat.h |
| |
182 | #define __S_IFMT 0170000 /* These bits determine file type. */ |
| |
x /usr/include/bits/stat.h |
| |
189 | #define __S_IFIFO 0010000 /* FIFO. */ |
| |
|
Event 6:
Skipping " if". (pipe_stat.st_mode & 61440) == 4096 evaluates to true.
hide
|
|
| 870 | | | if (S_ISCHR(pipe_stat.st_mode)) {
x /usr/include/sys/stat.h |
| |
132 | #define S_ISCHR(mode) __S_ISTYPE((mode), __S_IFCHR) |
| |
x /usr/include/sys/stat.h |
| |
129 | #define __S_ISTYPE(mode, mask) (((mode) & __S_IFMT) == (mask)) |
| |
x /usr/include/bits/stat.h |
| |
182 | #define __S_IFMT 0170000 /* These bits determine file type. */ |
| |
x /usr/include/bits/stat.h |
| |
186 | #define __S_IFCHR 0020000 /* Character device. */ |
| |
|
| 871 | | | |
| 872 | | | |
| 873 | | | |
| 874 | | | |
| 875 | | | ld->cap_pipe_err = PIPNEXIST; |
| 876 | | | } else |
| 877 | | | { |
| 878 | | | g_snprintf(errmsg, errmsgl, |
| 879 | | | "The capture session could not be initiated because\n" |
| 880 | | | "\"%s\" is neither an interface nor a pipe", pipename); |
| 881 | | | ld->cap_pipe_err = PIPERR; |
| 882 | | | } |
| 883 | | | return -1; |
| 884 | | | } |
| 885 | | | fd = ws_open(pipename, O_RDONLY | O_NONBLOCK, 0000 );
x /usr/include/bits/fcntl.h |
| |
43 | #define O_NONBLOCK 04000 |
| |
|
Event 7:
pipename is passed to open() as the first argument.
hide
File System Race Condition
The file named pipename is accessed again. Another process may have changed the file since the access at dumpcap.c:858. For example, an attacker could replace the original file with a link to a file containing important or confidential data. The issue can occur if the highlighted code executes. See related events 4 and 7. Show: All events | Only primary events |
|
| |