(/home/sate/Testcases/c/cve/wireshark-1.2.0/gtk/main_proto_draw.c) |
| |
| 842 | | | savehex_save_clicked_cb(GtkWidget * w _U_, gpointer data _U_) |
| 843 | | | { |
| 844 | | | GtkWidget *bv; |
| 845 | | | int fd, start, end; |
| 846 | | | guint len; |
| 847 | | | const guint8 *data_p = NULL; |
| 848 | | | char *file; |
| 849 | | | |
| 850 | | | file = gtk_file_chooser_get_filename(GTK_FILE_CHOOSER(savehex_dlg));
x /usr/include/gtk-2.0/gtk/gtkfilechooser.h |
| |
34 | #define GTK_FILE_CHOOSER(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GTK_TYPE_FILE_CHOOSER, GtkFileChooser)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/gtk-2.0/gtk/gtkfilechooser.h |
| |
33 | #define GTK_TYPE_FILE_CHOOSER (gtk_file_chooser_get_type ()) |
| |
|
| 851 | | | |
| 852 | | | #if 0 |
| 853 | | | if (!file ||! *file) { |
| 854 | | | simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK, "Please enter a filename!"); |
| 855 | | | g_free(file); |
| 856 | | | return TRUE; |
| 857 | | | } |
| 858 | | | #endif |
| 859 | [+] | | if (test_for_directory(file) == EISDIR) {
x /usr/include/asm-generic/errno-base.h |
| |
24 | #define EISDIR 21 /* Is a directory */ |
| |
|
Event 5:
file, which evaluates to gtk_file_chooser_get_filename(...) from main_proto_draw.c:850, is passed to test_for_directory(). See related event 4.
hide
|
|
 |
| 860 | | | |
| 861 | | | |
| 862 | | | set_last_open_dir(file); |
| 863 | | | g_free(file); |
| 864 | | | file_selection_set_current_folder(savehex_dlg, get_last_open_dir()); |
| 865 | | | gtk_file_chooser_set_current_name(GTK_FILE_CHOOSER(savehex_dlg), "");
x /usr/include/gtk-2.0/gtk/gtkfilechooser.h |
| |
34 | #define GTK_FILE_CHOOSER(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GTK_TYPE_FILE_CHOOSER, GtkFileChooser)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/gtk-2.0/gtk/gtkfilechooser.h |
| |
33 | #define GTK_TYPE_FILE_CHOOSER (gtk_file_chooser_get_type ()) |
| |
|
| 866 | | | return FALSE; |
| 867 | | | } |
| 868 | | | |
| 869 | | | |
| 870 | | | |
| 871 | [+] | | bv = get_notebook_bv_ptr(byte_nb_ptr); |
 |
| 872 | | | if (bv == NULL) { |
Event 20:
Skipping " if". bv == (void *)0 evaluates to false.
hide
|
|
| 873 | | | |
| 874 | | | simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK, "Could not find the corresponding text window!"); |
| 875 | | | g_free(file); |
| 876 | | | return TRUE; |
| 877 | | | } |
| 878 | | | |
| 879 | | | |
| 880 | | | |
| 881 | | | end = GPOINTER_TO_INT(g_object_get_data(G_OBJECT(bv), E_BYTE_VIEW_START_KEY));
x /usr/include/glib-2.0/gobject/gobject.h |
| |
52 | #define G_OBJECT(object) (G_TYPE_CHECK_INSTANCE_CAST ((object), G_TYPE_OBJECT, GObject)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
181 | #define G_TYPE_OBJECT G_TYPE_MAKE_FUNDAMENTAL (20) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
222 | #define G_TYPE_MAKE_FUNDAMENTAL(x) ((GType) ((x) << G_TYPE_FUNDAMENTAL_SHIFT)) |
| |
|
| 882 | | | start = GPOINTER_TO_INT(g_object_get_data(G_OBJECT(bv), E_BYTE_VIEW_END_KEY));
x /usr/include/glib-2.0/gobject/gobject.h |
| |
52 | #define G_OBJECT(object) (G_TYPE_CHECK_INSTANCE_CAST ((object), G_TYPE_OBJECT, GObject)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
181 | #define G_TYPE_OBJECT G_TYPE_MAKE_FUNDAMENTAL (20) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
222 | #define G_TYPE_MAKE_FUNDAMENTAL(x) ((GType) ((x) << G_TYPE_FUNDAMENTAL_SHIFT)) |
| |
|
| 883 | [+] | | data_p = get_byte_view_data_and_length(bv, &len); |
 |
| 884 | | | |
| 885 | | | if (data_p == NULL || start == -1 || start > end) { |
Event 31:
Skipping " if". - data_p == (void *)0 evaluates to false.
- start == -1 evaluates to false.
- start > end evaluates to false.
hide
|
|
| 886 | | | simple_dialog(ESD_TYPE_ERROR, ESD_BTN_OK, |
| 887 | | | "No data selected to save!"); |
| 888 | | | g_free(file); |
| 889 | | | return TRUE; |
| 890 | | | } |
| 891 | | | |
| 892 | | | fd = ws_open(file, O_WRONLY|O_CREAT|O_TRUNC|O_BINARY, 0666);
x /usr/include/bits/fcntl.h |
| |
38 | #define O_CREAT 0100 /* not fcntl */ |
| |
x /usr/include/bits/fcntl.h |
| |
41 | #define O_TRUNC 01000 /* not fcntl */ |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/wsutil/file_util.h |
| |
105 | #define O_BINARY 0 /* Win32 needs the O_BINARY flag for open() */ |
| |
|
Event 32:
file, which evaluates to gtk_file_chooser_get_filename(...) from main_proto_draw.c:850, is passed to open() as the first argument. See related events 4 and 7.
hide
File System Race Condition
The file named file is accessed again. Another process may have changed the file since the access at filesystem.c:215. For example, an attacker could replace the original file with a link to a file containing important or confidential data. The issue can occur if the highlighted code executes. See related events 8 and 32. Show: All events | Only primary events |
|
| |