(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-snmp.c) |
| |
| 457 | | | extern int dissect_snmp_VarBind(gboolean implicit_tag _U_, |
| 458 | | | tvbuff_t *tvb, |
| 459 | | | int offset, |
| 460 | | | asn1_ctx_t *actx, |
| 461 | | | proto_tree *tree, |
| 462 | | | int hf_index _U_) { |
| 463 | | | int seq_offset, name_offset, value_offset, value_start; |
| 464 | | | guint32 seq_len, name_len, value_len; |
| 465 | | | gint8 ber_class; |
| 466 | | | gboolean pc; |
| 467 | | | gint32 tag; |
| 468 | | | gboolean ind; |
| 469 | | | guint32* subids; |
| 470 | | | guint8* oid_bytes; |
| 471 | | | oid_info_t* oid_info = NULL; |
| 472 | | | guint oid_matched, oid_left; |
| 473 | | | proto_item *pi_name, *pi_varbind, *pi_value = NULL; |
| 474 | | | proto_tree *pt, *pt_varbind, *pt_name, *pt_value; |
| 475 | | | char label[ITEM_LABEL_LENGTH]; |
| 476 | | | char* repr = NULL; |
| 477 | | | const char* info_oid = NULL; |
| 478 | | | char* valstr; |
| 479 | | | int hfid = -1; |
| 480 | | | int min_len = 0, max_len = 0; |
| 481 | | | gboolean oid_info_is_ok; |
| 482 | | | const char* oid_string = NULL; |
| 483 | | | enum {BER_NO_ERROR, BER_WRONG_LENGTH, BER_WRONG_TAG} format_error = BER_NO_ERROR; |
| 484 | | | |
| 485 | | | seq_offset = offset; |
| 486 | | | |
| 487 | | | |
| 488 | [+] | | offset = get_ber_identifier(tvb, offset, &ber_class, &pc, &tag); |
 |
| 489 | [+] | | offset = get_ber_length(tvb, offset, &seq_len, &ind); |
 |
| 490 | | | |
| 491 | | | seq_len += offset - seq_offset; |
| 492 | | | |
| 493 | | | if (!pc && ber_class==BER_CLASS_UNI && tag==BER_UNI_TAG_SEQUENCE) { |
Event 8:
Skipping " if". pc evaluates to true.
hide
|
|
| 494 | | | proto_item* pi = proto_tree_add_text(tree, tvb, seq_offset, seq_len,"VarBind must be an universal class sequence"); |
| 495 | | | pt = proto_item_add_subtree(pi,ett_decoding_error); |
| 496 | | | expert_add_info_format(actx->pinfo, pi, PI_MALFORMED, PI_WARN, "VarBind is not an universal class sequence"); |
| 497 | | | return dissect_unknown_ber(actx->pinfo, tvb, seq_offset, pt); |
| 498 | | | } |
| 499 | | | |
| 500 | | | if (ind){ |
Event 9:
Skipping " if". ind evaluates to false.
hide
|
|
| 501 | | | proto_item* pi = proto_tree_add_text(tree, tvb, seq_offset, seq_len,"Indicator must be clear in VarBind"); |
| 502 | | | pt = proto_item_add_subtree(pi,ett_decoding_error); |
| 503 | | | expert_add_info_format(actx->pinfo, pi, PI_MALFORMED, PI_WARN, "VarBind has indicator set"); |
| 504 | | | return dissect_unknown_ber(actx->pinfo, tvb, seq_offset, pt); |
| 505 | | | } |
| 506 | | | |
| 507 | | | |
| 508 | | | |
| 509 | [+] | | offset = get_ber_identifier(tvb, offset, &ber_class, &pc, &tag); |
 |
| 510 | [+] | | name_offset = offset = get_ber_length(tvb, offset, &name_len, &ind); |
 |
| 511 | | | |
| 512 | | | if (! ( !pc && ber_class==BER_CLASS_UNI && tag==BER_UNI_TAG_OID) ) { |
Event 17:
Skipping " if". - pc evaluates to false.
- ber_class == 0 evaluates to true.
- tag == 6 evaluates to true.
hide
|
|
| 513 | | | proto_item* pi = proto_tree_add_text(tree, tvb, seq_offset, seq_len,"ObjectName must be an OID in primitive encoding"); |
| 514 | | | pt = proto_item_add_subtree(pi,ett_decoding_error); |
| 515 | | | expert_add_info_format(actx->pinfo, pi, PI_MALFORMED, PI_WARN, "ObjectName not an OID"); |
| 516 | | | return dissect_unknown_ber(actx->pinfo, tvb, seq_offset, pt); |
| 517 | | | } |
| 518 | | | |
| 519 | | | if (ind){ |
Event 18:
Skipping " if". ind evaluates to false.
hide
|
|
| 520 | | | proto_item* pi = proto_tree_add_text(tree, tvb, seq_offset, seq_len,"Indicator must be clear in ObjectName"); |
| 521 | | | pt = proto_item_add_subtree(pi,ett_decoding_error); |
| 522 | | | expert_add_info_format(actx->pinfo, pi, PI_MALFORMED, PI_WARN, "ObjectName has indicator set"); |
| 523 | | | return dissect_unknown_ber(actx->pinfo, tvb, seq_offset, pt); |
| 524 | | | } |
| 525 | | | |
| 526 | | | offset += name_len; |
| 527 | | | value_start = offset; |
| 528 | | | |
| 529 | | | |
| 530 | [+] | | offset = get_ber_identifier(tvb, offset, &ber_class, &pc, &tag); |
 |
| 531 | | | value_offset = offset = get_ber_length(tvb, offset, &value_len, &ind); |
| 532 | | | |
| 533 | | | if (! (!pc) ) { |
Event 23:
Skipping " if". pc evaluates to false.
hide
|
|
| 534 | | | proto_item* pi = proto_tree_add_text(tree, tvb, seq_offset, seq_len,"the value must be in primitive encoding"); |
| 535 | | | pt = proto_item_add_subtree(pi,ett_decoding_error); |
| 536 | | | expert_add_info_format(actx->pinfo, pi, PI_MALFORMED, PI_WARN, "value not in primitive encoding"); |
| 537 | | | return dissect_unknown_ber(actx->pinfo, tvb, seq_offset, pt); |
| 538 | | | } |
| 539 | | | |
| 540 | | | |
| 541 | | | |
| 542 | | | |
| 543 | | | |
| 544 | | | |
| 545 | | | pi_varbind = proto_tree_add_text(tree,tvb,seq_offset,seq_len,"VarBind"); |
| 546 | | | pt_varbind = proto_item_add_subtree(pi_varbind,ett_varbind); |
| 547 | | | *label = '\0'; |
| 548 | | | |
| 549 | | | pi_name = proto_tree_add_item(pt_varbind,hf_snmp_objectname,tvb,name_offset,name_len,FALSE); |
| 550 | | | pt_name = proto_item_add_subtree(pi_name,ett_name); |
| 551 | | | |
| 552 | | | |
| 553 | | | oid_bytes = ep_tvb_memdup(tvb, name_offset, name_len); |
| 554 | [+] | | oid_info = oid_get_from_encoded(oid_bytes, name_len, &subids, &oid_matched, &oid_left); |
Event 24:
&subids is passed to oid_get_from_encoded() as the third argument.
hide
|
|
 |
| 555 | | | |
| 556 | | | add_oid_debug_subtree(oid_info,pt_name); |
| 557 | | | |
| 558 | | | if (subids && oid_matched+oid_left) { |
Event 41:
Skipping " if". subids evaluates to false.
hide
|
|
| 559 | | | oid_string = oid_subid2string(subids,oid_matched+oid_left); |
| 560 | | | } |
| 561 | | | |
| 562 | | | if (ber_class == BER_CLASS_CON) { |
Event 42:
Skipping " if". ber_class == 2 evaluates to false.
hide
|
|
| 563 | | | |
| 564 | | | proto_item* pi; |
| 565 | | | const char* note; |
| 566 | | | |
| 567 | | | if (value_len != 0) { |
| 568 | | | min_len = max_len = 0; |
| 569 | | | format_error = BER_WRONG_LENGTH; |
| 570 | | | } |
| 571 | | | |
| 572 | | | switch (tag) { |
| 573 589 |  | | [ Lines 573 to 589 omitted. ] |
| 590 | | | } |
| 591 | | | } |
| 592 | | | |
| 593 | | | pi = proto_tree_add_item(pt_varbind,hfid,tvb,value_offset,value_len,FALSE); |
| 594 | | | expert_add_info_format(actx->pinfo, pi, PI_RESPONSE_CODE, PI_NOTE, "%s",note); |
| 595 | | | g_strlcpy (label, note, ITEM_LABEL_LENGTH); |
| 596 | | | goto set_label; |
| 597 | | | } |
| 598 | | | |
| 599 | | | |
| 600 | | | switch (oid_info->kind) { |
Event 43:
oid_info->kind evaluates to 2.
hide
|
|
| 601 | | | case OID_KIND_SCALAR: |
| 602 | | | if (oid_left == 1) { |
Event 44:
Taking true branch. oid_left == 1 evaluates to true.
hide
|
|
| 603 | | | |
| 604 | | | proto_tree_add_uint64(pt_name,hf_snmp_scalar_instance_index,tvb,name_offset,name_len,subids[oid_matched]); |
Null Pointer Dereference
subids is dereferenced here, but it is NULL. The issue can occur if the highlighted code executes. See related events 35 and 40. Show: All events | Only primary events |
|
| |