(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-h248.c) |
| |
| 1528 | | | static int dissect_h248_PropertyID(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, asn1_ctx_t *actx _U_, proto_tree *tree, int hf_index _U_) { |
| 1529 | | | |
| 1530 | | | gint8 class; |
| 1531 | | | gboolean pc, ind; |
| 1532 | | | gint32 tag; |
| 1533 | | | guint32 len; |
| 1534 | | | guint16 name_major; |
| 1535 | | | guint16 name_minor; |
| 1536 | | | int old_offset, end_offset; |
| 1537 | | | tvbuff_t *next_tvb; |
| 1538 | | | const h248_package_t* pkg; |
| 1539 | | | const h248_pkg_param_t* prop; |
| 1540 | | | |
| 1541 | | | old_offset=offset; |
| 1542 | [+] | | offset=dissect_ber_identifier(actx->pinfo, tree, tvb, offset, &class, &pc, &tag); |
 |
| 1543 | | | offset=dissect_ber_length(actx->pinfo, tree, tvb, offset, &len, &ind); |
| 1544 | | | end_offset=offset+len; |
| 1545 | | | |
| 1546 | | | if( (class!=BER_CLASS_UNI) |
Event 9:
Skipping " if". - class != 0 evaluates to false.
- tag != 4 evaluates to false.
hide
|
|
| 1547 | | | ||(tag!=BER_UNI_TAG_OCTETSTRING) ){ |
| 1548 | | | proto_tree_add_text(tree, tvb, offset-2, 2, "H.248 BER Error: OctetString expected but Class:%d PC:%d Tag:%d was unexpected", class, pc, tag); |
| 1549 | | | return end_offset; |
| 1550 | | | } |
| 1551 | | | |
| 1552 | | | |
| 1553 | | | next_tvb = tvb_new_subset(tvb, offset , len , len ); |
| 1554 | | | name_major = packageandid >> 16; |
| 1555 | | | name_minor = packageandid & 0xffff; |
| 1556 | | | |
| 1557 | | | pkg = (curr_info.pkg) ? curr_info.pkg : &no_package; |
Event 10:
curr_info.pkg evaluates to false.
hide
|
|
| 1558 | | | |
| 1559 | | | if (pkg->properties) { |
Event 11:
Taking false branch. pkg->properties evaluates to false.
hide
|
|
| 1560 | | | for (prop = pkg->properties; prop && prop->hfid; prop++) { |
| 1561 | | | if (name_minor == prop->id) { |
| 1562 | | | break; |
| 1563 | | | } |
| 1564 | | | } |
| 1565 | | | } else { |
| 1566 | | | prop = &no_param; |
Event 12:
prop is set to &no_param.
hide
|
|
| 1567 | | | } |
| 1568 | | | |
| 1569 | | | if (prop && prop->hfid ) { |
| 1570 | | | if (!prop->dissector) prop = &no_param; |
Event 14:
Taking true branch. prop->dissector evaluates to false.
hide
Event 15:
Considering the case where prop->dissector is equal to 0 so no_param.dissector must have been equal to 0. See related event 12.
hide
Event 16:
prop is set to &no_param. - Dereferenced later, causing the null pointer dereference.
hide
|
|
| 1571 | | | prop->dissector(tree, next_tvb, actx->pinfo, *(prop->hfid), &curr_info, prop->data); |
Null Pointer Dereference
prop->dissector is dereferenced here, but it is NULL. - prop->dissector evaluates to no_param.dissector, which must be equal to 0.
The issue can occur if the highlighted code executes. See related events 15 and 16. Show: All events | Only primary events |
|
| |