(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-pop.c) |
| |
| 117 | | | dissect_pop(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) |
| 118 | | | { |
| 119 | | | struct pop_proto_data *frame_data; |
| 120 | | | gboolean is_request; |
| 121 | | | gboolean is_continuation; |
| 122 | | | proto_tree *pop_tree, *reqresp_tree; |
| 123 | | | proto_item *ti; |
| 124 | | | gint offset = 0; |
| 125 | | | const guchar *line; |
| 126 | | | gint next_offset; |
| 127 | | | int linelen; |
| 128 | | | int tokenlen; |
| 129 | | | const guchar *next_token; |
| 130 | | | fragment_data *frag_msg = NULL; |
| 131 | | | tvbuff_t *next_tvb = NULL; |
| 132 | | | conversation_t *conversation = NULL; |
| 133 | | | struct pop_data_val *data_val = NULL; |
| 134 | | | gint length_remaining; |
| 135 | | | |
| 136 | | | if (check_col(pinfo->cinfo, COL_PROTOCOL)) |
Event 1:
Taking true branch. check_col(...) evaluates to true.
hide
|
|
| 137 | | | col_set_str(pinfo->cinfo, COL_PROTOCOL, "POP"); |
| 138 | | | |
| 139 | | | |
| 140 | | | |
| 141 | | | |
| 142 | | | |
| 143 | | | |
| 144 | | | |
| 145 | | | |
| 146 | | | linelen = tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE); |
| 147 | | | line = tvb_get_ptr(tvb, offset, linelen); |
| 148 | | | |
| 149 | | | if (pinfo->match_port == pinfo->destport) { |
Event 2:
Taking false branch. pinfo->match_port == pinfo->destport evaluates to false.
hide
|
|
| 150 | | | is_request = TRUE; |
| 151 | | | is_continuation = FALSE; |
| 152 | | | } else { |
| 153 | | | is_request = FALSE; |
| 154 | | | is_continuation = response_is_continuation(line); |
| 155 | | | } |
| 156 | | | |
| 157 | | | frame_data = p_get_proto_data(pinfo->fd, proto_pop); |
| 158 | | | |
| 159 | | | if (!frame_data) { |
Event 3:
Taking true branch. frame_data evaluates to false.
hide
|
|
| 160 | | | |
| 161 | | | conversation = find_conversation(pinfo->fd->num, |
| 162 | | | &pinfo->src, &pinfo->dst, |
| 163 | | | pinfo->ptype, |
| 164 | | | pinfo->srcport, pinfo->destport, 0); |
| 165 | | | |
| 166 | | | if (conversation == NULL) { |
Event 4:
Taking true branch. conversation == (void *)0 evaluates to true.
hide
|
|
| 167 | | | conversation = conversation_new(pinfo->fd->num, |
| 168 | | | &pinfo->src, &pinfo->dst, pinfo->ptype, |
| 169 | | | pinfo->srcport, pinfo->destport, 0); |
| 170 | | | } |
| 171 | | | |
| 172 | | | data_val = conversation_get_proto_data(conversation, proto_pop); |
| 173 | | | |
| 174 | | | if (!data_val) { |
Event 5:
Taking true branch. data_val evaluates to false.
hide
|
|
| 175 | | | |
| 176 | | | |
| 177 | | | |
| 178 | | | |
| 179 | | | data_val = se_alloc(sizeof(struct pop_data_val)); |
| 180 | | | data_val->msg_request = FALSE; |
| 181 | | | data_val->msg_read_len = 0; |
| 182 | | | data_val->msg_tot_len = 0; |
| 183 | | | |
| 184 | | | conversation_add_proto_data(conversation, proto_pop, data_val); |
| 185 | | | } |
| 186 | | | } |
| 187 | | | |
| 188 | | | if (check_col(pinfo->cinfo, COL_INFO)) { |
Event 6:
Taking true branch. check_col(...) evaluates to true.
hide
|
|
| 189 | | | |
| 190 | | | |
| 191 | | | |
| 192 | | | |
| 193 | | | |
| 194 | | | |
| 195 | | | if (is_continuation) { |
Event 7:
Taking true branch. is_continuation evaluates to true.
hide
|
|
| 196 | | | length_remaining = tvb_length_remaining(tvb, offset); |
| 197 | | | col_set_str(pinfo->cinfo, COL_INFO, "S: DATA fragment"); |
| 198 | | | col_append_fstr(pinfo->cinfo, COL_INFO, ", %d byte%s", |
| 199 | | | length_remaining, |
| 200 | | | plurality (length_remaining, "", "s")); |
Event 8:
length_remaining == 1 evaluates to true.
hide
|
|
| 201 | | | } |
| 202 | | | else |
| 203 | | | col_add_fstr(pinfo->cinfo, COL_INFO, "%s: %s", |
| 204 | | | is_request ? "C" : "S", |
| 205 | | | format_text(line, linelen)); |
| 206 | | | } |
| 207 | | | |
| 208 | | | if (tree) { |
Event 9:
Taking true branch. tree evaluates to true.
hide
|
|
| 209 | | | ti = proto_tree_add_item(tree, proto_pop, tvb, offset, -1, |
| 210 | | | FALSE); |
| 211 | | | pop_tree = proto_item_add_subtree(ti, ett_pop); |
| 212 | | | |
| 213 | | | if (is_continuation) { |
Event 10:
Taking true branch. is_continuation evaluates to true.
hide
|
|
| 214 | | | |
| 215 | | | if(pop_data_desegment) { |
Event 11:
Taking true branch. pop_data_desegment evaluates to true.
hide
|
|
| 216 | | | |
| 217 | | | if(!frame_data) { |
Event 12:
Taking true branch. frame_data evaluates to false.
hide
|
|
| 218 | | | |
| 219 | | | data_val->msg_read_len += tvb_length(tvb); |
| 220 | | | |
| 221 | | | frame_data = se_alloc(sizeof(struct pop_proto_data)); |
| 222 | | | |
| 223 | | | frame_data->conversation_id = conversation->index; |
| 224 | | | frame_data->more_frags = data_val->msg_read_len < data_val->msg_tot_len; |
Event 13:
data_val->msg_read_len < data_val->msg_tot_len evaluates to true.
hide
|
|
| 225 | | | |
| 226 | | | p_add_proto_data(pinfo->fd, proto_pop, frame_data); |
| 227 | | | } |
| 228 | | | |
| 229 | | | frag_msg = fragment_add_seq_next (tvb, 0, pinfo, |
| 230 | | | frame_data->conversation_id, |
| 231 | | | pop_data_segment_table, |
| 232 | | | pop_data_reassembled_table, |
| 233 | | | tvb_length(tvb), |
| 234 | | | frame_data->more_frags); |
| 235 | | | |
| 236 | | | next_tvb = process_reassembled_data (tvb, offset, pinfo, |
| 237 | | | "Reassembled DATA", |
| 238 | | | frag_msg, &pop_data_frag_items, |
| 239 | | | NULL, pop_tree); |
| 240 | | | |
| 241 | | | if(next_tvb) { |
Event 15:
Taking true branch. next_tvb evaluates to true.
hide
|
|
| 242 | | | |
| 243 | | | if(imf_handle) |
Event 16:
Skipping " if". imf_handle evaluates to false.
hide
|
|
| 244 | | | call_dissector(imf_handle, next_tvb, pinfo, tree); |
| 245 | | | |
| 246 | | | if(data_val) { |
Null Test After Dereference
This code tests the nullness of data_val, which has already been dereferenced. - If data_val were null, there would have been a prior null pointer dereference at packet-pop.c:224, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 14. Show: All events | Only primary events |
|
| 247 | | | |
| 248 | | | |
| 249 | | | data_val->msg_read_len = 0; |
| 250 | | | data_val->msg_tot_len = 0; |
| 251 | | | } |
| 252 | | | pinfo->fragmented = FALSE; |
| 253 | | | } else { |
| 254 | | | pinfo->fragmented = TRUE; |
| 255 | | | } |
| 256 | | | |
| 257 | | | } else { |
| 258 | | | |
| 259 | | | |
| 260 | | | |
| 261 | | | |
| 262 | | | call_dissector(data_handle,tvb, pinfo, pop_tree); |
| 263 | | | |
| 264 | | | } |
| 265 | | | return; |
| 266 | | | } |
| 267 | | | |
| 268 | | | |
| 269 | | | |
| 270 | | | |
| 271 | | | ti = proto_tree_add_string_format(pop_tree, |
| 272 | | | (is_request) ? |
| 273 | | | hf_pop_request : |
| 274 | | | hf_pop_response, |
| 275 | | | tvb, offset, |
| 276 | | | next_offset - offset, |
| 277 | | | "", "%s", |
| 278 | | | tvb_format_text(tvb, offset, next_offset - offset)); |
| 279 | | | reqresp_tree = proto_item_add_subtree(ti, ett_pop_reqresp); |
| 280 | | | |
| 281 | | | |
| 282 | | | |
| 283 | | | |
| 284 | | | |
| 285 | | | tokenlen = get_token_len(line, line + linelen, &next_token); |
| 286 | | | if (tokenlen != 0) { |
| 287 | | | proto_tree_add_item(reqresp_tree, |
| 288 | | | (is_request) ? |
| 289 | | | hf_pop_request_command : |
| 290 | | | hf_pop_response_indicator, |
| 291 | | | tvb, offset, tokenlen, FALSE); |
| 292 | | | |
| 293 | | | if(is_request) { |
| 294 | | | |
| 295 | | | if((g_ascii_strncasecmp(line, "RETR", 4) == 0) || |
| 296 | | | (g_ascii_strncasecmp(line, "TOP", 3) == 0)) |
| 297 | | | |
| 298 | | | data_val->msg_request = TRUE; |
| 299 | | | } else { |
| 300 | | | if(data_val->msg_request) { |
| 301 | | | |
| 302 | | | |
| 303 | | | if(g_ascii_strncasecmp(line, "+OK ", 4) == 0) { |
| 304 | | | |
| 305 | | | data_val->msg_read_len = 0; |
| 306 | | | data_val->msg_tot_len = atoi(line + 4); |
| 307 | | | } |
| 308 | | | data_val->msg_request = FALSE; |
| 309 | | | } |
| 310 | | | } |
| 311 | | | |
| 312 | | | offset += (gint) (next_token - line); |
| 313 | | | linelen -= (int) (next_token - line); |
| 314 | | | line = next_token; |
| 315 | | | |
| 316 | | | } |
| 317 | | | |
| 318 | | | |
| 319 | | | |
| 320 | | | |
| 321 | | | |
| 322 | | | if (linelen != 0) { |
| 323 | | | proto_tree_add_item(reqresp_tree, |
| 324 | | | (is_request) ? |
| 325 | | | hf_pop_request_parameter : |
| 326 | | | hf_pop_response_description, |
| 327 | | | tvb, offset, linelen, FALSE); |
| 328 | | | } |
| 329 | | | offset = next_offset; |
| 330 | | | |
| 331 | | | |
| 332 | | | |
| 333 | | | |
| 334 | | | |
| 335 | | | while (tvb_offset_exists(tvb, offset)) { |
| 336 | | | |
| 337 | | | |
| 338 | | | |
| 339 | | | linelen = tvb_find_line_end(tvb, offset, -1, |
| 340 | | | &next_offset, FALSE); |
| 341 | | | |
| 342 | | | |
| 343 | | | |
| 344 | | | |
| 345 | | | proto_tree_add_string_format(pop_tree, |
| 346 | | | (is_request) ? |
| 347 | | | hf_pop_request_data : |
| 348 | | | hf_pop_response_data, |
| 349 | | | tvb, offset, |
| 350 | | | next_offset - offset, |
| 351 | | | "", "%s", |
| 352 | | | tvb_format_text(tvb, offset, next_offset - offset)); |
| 353 | | | offset = next_offset; |
| 354 | | | } |
| 355 | | | } |
| 356 | | | } |
| |