(/home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/profinet/packet-dcerpc-pn-io.c) |
| |
| 1618 | | | dissect_PNIO_status(tvbuff_t *tvb, int offset, |
| 1619 | | | packet_info *pinfo, proto_tree *tree, guint8 *drep) |
| 1620 | | | { |
| 1621 | | | guint8 u8ErrorCode; |
| 1622 | | | guint8 u8ErrorDecode; |
| 1623 | | | guint8 u8ErrorCode1; |
| 1624 | | | guint8 u8ErrorCode2; |
| 1625 | | | |
| 1626 | | | proto_item *sub_item; |
| 1627 | | | proto_tree *sub_tree; |
| 1628 | | | guint32 u32SubStart; |
| 1629 | | | int bytemask = (drep[0] & 0x10) ? 3 : 0; |
Event 1:
drep[0] & 16 evaluates to false.
hide
|
|
| 1630 | | | const value_string *error_code1_vals; |
| 1631 | | | const value_string *error_code2_vals = pn_io_error_code2; |
| 1632 | | | |
| 1633 | | | |
| 1634 | | | |
| 1635 | | | |
| 1636 | | | sub_item = proto_tree_add_item(tree, hf_pn_io_status, tvb, offset, 0, FALSE); |
| 1637 | | | sub_tree = proto_item_add_subtree(sub_item, ett_pn_io_status); |
| 1638 | | | u32SubStart = offset; |
| 1639 | | | |
| 1640 | | | |
| 1641 | | | |
| 1642 | | | |
| 1643 | | | |
| 1644 | | | |
| 1645 | | | dissect_dcerpc_uint8(tvb, offset+(0^bytemask), pinfo, sub_tree, drep, |
| 1646 | [+] | | hf_pn_io_error_code, &u8ErrorCode); |
 |
| 1647 | | | dissect_dcerpc_uint8(tvb, offset+(1^bytemask), pinfo, sub_tree, drep, |
| 1648 | | | hf_pn_io_error_decode, &u8ErrorDecode); |
| 1649 | | | |
| 1650 | | | switch(u8ErrorDecode) { |
Event 18:
u8ErrorDecode evaluates to 128.
hide
|
|
| 1651 | | | case(0x80): |
| 1652 | | | dissect_dcerpc_uint8(tvb, offset+(2^bytemask), pinfo, sub_tree, drep, |
| 1653 | | | hf_pn_io_error_code1_pniorw, &u8ErrorCode1); |
| 1654 | | | error_code1_vals = pn_io_error_code1_pniorw; |
| 1655 | | | |
| 1656 | | | |
| 1657 | | | dissect_dcerpc_uint8(tvb, offset+(3^bytemask), pinfo, sub_tree, drep, |
| 1658 | | | hf_pn_io_error_code2_pniorw, &u8ErrorCode2); |
| 1659 | | | |
| 1660 | | | error_code2_vals = pn_io_error_code2_pniorw; |
Event 19:
error_code2_vals is set to pn_io_error_code2_pniorw. - This points to the buffer that will be overrun later.
hide
|
|
| 1661 | | | |
| 1662 | | | break; |
| 1663 | | | case(0x81): |
| 1664 | | | dissect_dcerpc_uint8(tvb, offset+(2^bytemask), pinfo, sub_tree, drep, |
| 1665 | | | hf_pn_io_error_code1_pnio, &u8ErrorCode1); |
| 1666 | | | error_code1_vals = pn_io_error_code1_pnio; |
| 1667 | | | |
| 1668 | | | switch(u8ErrorCode1) { |
| 1669 | | | case(22): |
| 1670 | | | dissect_dcerpc_uint8(tvb, offset+(3^bytemask), pinfo, sub_tree, drep, |
| 1671 | | | hf_pn_io_error_code2_pnio_22, &u8ErrorCode2); |
| 1672 | | | error_code2_vals = pn_io_error_code2_pnio_22; |
| 1673 1700 |  | | [ Lines 1673 to 1700 omitted. ] |
| 1701 | | | |
| 1702 | | | |
| 1703 | | | dissect_dcerpc_uint8(tvb, offset+(3^bytemask), pinfo, sub_tree, drep, |
| 1704 | | | hf_pn_io_error_code2, &u8ErrorCode2); |
| 1705 | | | if(u8ErrorDecode != 0) { |
| 1706 | | | expert_add_info_format(pinfo, sub_item, PI_UNDECODED, PI_WARN, |
| 1707 | | | "Unknown ErrorDecode 0x%x", u8ErrorDecode); |
| 1708 | | | } |
| 1709 | | | } |
| 1710 | | | |
| 1711 | | | offset +=4; |
| 1712 | | | |
| 1713 | | | if(u8ErrorCode == 0 && u8ErrorDecode == 0 && u8ErrorCode1 == 0 && u8ErrorCode2 == 0) { |
Event 20:
Taking false branch. u8ErrorCode == 0 evaluates to false.
hide
|
|
| 1714 | | | proto_item_append_text(sub_item, ": OK"); |
| 1715 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
| 1716 | | | col_append_str(pinfo->cinfo, COL_INFO, ", OK"); |
| 1717 | | | } else { |
| 1718 | | | proto_item_append_text(sub_item, ": Error: \"%s\", \"%s\", \"%s\", \"%s\"", |
| 1719 | | | val_to_str(u8ErrorCode, pn_io_error_code, "(0x%x)"), |
| 1720 | | | val_to_str(u8ErrorDecode, pn_io_error_decode, "(0x%x)"), |
| 1721 | | | val_to_str(u8ErrorCode1, error_code1_vals, "(0x%x)"), |
| 1722 | [+] | | val_to_str(u8ErrorCode2, error_code2_vals, "(0x%x)")); |
Event 21:
error_code2_vals, which evaluates to pn_io_error_code2_pniorw, is passed to val_to_str() as the second argument. See related event 19.
hide
|
|
 |
| |