(/home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/profinet/packet-dcerpc-pn-io.c) |
| |
| 1839 | | | dissect_AlarmUserStructure(tvbuff_t *tvb, int offset, |
| 1840 | | | packet_info *pinfo, proto_tree *tree, proto_item *item, guint8 *drep, |
| 1841 | | | guint16 *body_length, guint16 u16UserStructureIdentifier) |
| 1842 | | | { |
| 1843 | | | guint16 u16ChannelNumber; |
| 1844 | | | guint16 u16ChannelErrorType; |
| 1845 | | | guint16 u16ExtChannelErrorType; |
| 1846 | | | guint32 u32ExtChannelAddValue; |
| 1847 | | | guint16 u16Index; |
| 1848 | | | guint32 u32RecDataLen; |
| 1849 | | | pnio_ar_t *ar = NULL; |
| 1850 | | | |
| 1851 | | | |
| 1852 | | | switch(u16UserStructureIdentifier) { |
Event 1:
u16UserStructureIdentifier evaluates to 33024.
hide
|
|
| 1853 | | | case(0x8000): |
| 1854 | | | offset = dissect_dcerpc_uint16(tvb, offset, pinfo, tree, drep, |
| 1855 | | | hf_pn_io_channel_number, &u16ChannelNumber); |
| 1856 | | | offset = dissect_ChannelProperties(tvb, offset, pinfo, tree, item, drep); |
| 1857 | | | offset = dissect_dcerpc_uint16(tvb, offset, pinfo, tree, drep, |
| 1858 | | | hf_pn_io_channel_error_type, &u16ChannelErrorType); |
| 1859 | | | *body_length -= 6; |
| 1860 | | | break; |
| 1861 | | | case(0x8002): |
| 1862 | | | offset = dissect_dcerpc_uint16(tvb, offset, pinfo, tree, drep, |
| 1863 | | | hf_pn_io_channel_number, &u16ChannelNumber); |
| 1864 | | | |
| 1865 | | | offset = dissect_ChannelProperties(tvb, offset, pinfo, tree, item, drep); |
| 1866 | | | |
| 1867 | | | offset = dissect_dcerpc_uint16(tvb, offset, pinfo, tree, drep, |
| 1868 | | | hf_pn_io_channel_error_type, &u16ChannelErrorType); |
| 1869 | | | offset = dissect_dcerpc_uint16(tvb, offset, pinfo, tree, drep, |
| 1870 | | | hf_pn_io_ext_channel_error_type, &u16ExtChannelErrorType); |
| 1871 | | | offset = dissect_dcerpc_uint32(tvb, offset, pinfo, tree, drep, |
| 1872 | | | hf_pn_io_ext_channel_add_value, &u32ExtChannelAddValue); |
| 1873 | | | *body_length -= 12; |
| 1874 | | | break; |
| 1875 | | | case(0x8100): |
| 1876 | [+] | | offset = dissect_block(tvb, offset, pinfo, tree, drep, &u16Index, &u32RecDataLen, &ar); |
Event 2:
&u16Index is passed to dissect_block() as the sixth argument.
hide
Event 3:
dissect_block() does not initialize u16Index. - This may be because of a failure case or other special case for dissect_block().
hide
|
|
 |
| |