(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-ieee80211.c) |
| |
| 6069 | | | dissect_ieee80211_common (tvbuff_t * tvb, packet_info * pinfo, |
| 6070 | | | proto_tree * tree, gboolean , gint fcs_len, |
| 6071 | | | gboolean wlan_broken_fc, gboolean datapad, |
| 6072 | | | gboolean is_ht) |
| 6073 | | | { |
| 6074 | | | guint16 fcf, flags, frame_type_subtype, ctrl_fcf, ctrl_type_subtype; |
| 6075 | | | guint16 seq_control; |
| 6076 | | | guint32 seq_number, frag_number; |
| 6077 | | | gboolean more_frags; |
| 6078 | | | const guint8 *src = NULL; |
| 6079 | | | const guint8 *dst = NULL; |
| 6080 | | | const guint8 *bssid = NULL; |
Event 1:
bssid is set to NULL. - Dereferenced later, causing the null pointer dereference.
hide
|
|
| 6081 | | | proto_item *ti = NULL; |
| 6082 | | | proto_item *fcs_item = NULL; |
| 6083 | | | proto_item *cw_item = NULL; |
| 6084 | | | proto_item *hidden_item; |
| 6085 | | | proto_tree *volatile hdr_tree = NULL; |
| 6086 | | | proto_tree *fcs_tree = NULL; |
| 6087 | | | proto_tree *cw_tree = NULL; |
| 6088 | | | guint16 hdr_len, ohdr_len, htc_len = 0; |
| 6089 | | | gboolean has_fcs, fcs_good, fcs_bad; |
| 6090 | | | gint len, reported_len, ivlen; |
| 6091 | | | gboolean is_amsdu = 0; |
| 6092 | | | gboolean save_fragmented; |
| 6093 | | | tvbuff_t *volatile next_tvb = NULL; |
| 6094 | | | guint32 addr_type; |
| 6095 | | | volatile encap_t encap_type; |
| 6096 | | | guint8 octet1, octet2; |
| 6097 | | | char out_buff[SHORT_STR]; |
| 6098 | | | gint is_iv_bad; |
| 6099 | | | guchar iv_buff[4]; |
| 6100 | | | const char *addr1_str = NULL; |
| 6101 | | | int addr1_hf = -1; |
| 6102 | | | guint offset; |
| 6103 | | | const gchar *fts_str; |
| 6104 | | | gchar flag_str[] = "opmPRMFTC"; |
| 6105 | | | gint i; |
| 6106 | | | |
| 6107 | | | wlan_hdr *volatile whdr; |
| 6108 | | | static wlan_hdr whdrs[4]; |
| 6109 | | | gboolean retransmitted; |
| 6110 | | | |
| 6111 | | | whdr= &whdrs[0]; |
| 6112 | | | |
| 6113 | | | if (check_col (pinfo->cinfo, COL_PROTOCOL)) |
Event 2:
Taking true branch. check_col(...) evaluates to true.
hide
|
|
| 6114 | | | col_set_str (pinfo->cinfo, COL_PROTOCOL, "IEEE 802.11"); |
| 6115 | [+] | | if (check_col (pinfo->cinfo, COL_INFO)) |
 |
| 6116 | | | col_clear (pinfo->cinfo, COL_INFO); |
| 6117 | | | |
| 6118 | | | fcf = FETCH_FCF(0);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-ieee80211.c |
| |
181 | #define FETCH_FCF(off) (wlan_broken_fc ? \ |
182 | BSWAP16(tvb_get_letohs(tvb, off)) : \ |
183 | tvb_get_letohs(tvb, off)) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/pint.h |
| |
105 | #define BSWAP16(x) \ |
106 | ((((x)&0xFF00)>>8) | \ |
107 | (((x)&0x00FF)<<8)) |
| |
|
Event 6:
wlan_broken_fc evaluates to true.
hide
|
|
| 6119 | | | frame_type_subtype = COMPOSE_FRAME_TYPE(fcf);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-ieee80211.c |
| |
204 | #define COMPOSE_FRAME_TYPE(x) (((x & 0x0C)<< 2)+FCF_FRAME_SUBTYPE(x)) /* Create key to (sub)type */ |
| |
|
| 6120 | | | if (frame_type_subtype == CTRL_CONTROL_WRAPPER) |
Event 7:
Taking false branch. frame_type_subtype == 23 evaluates to false.
hide
|
|
| 6121 | | | ctrl_fcf = FETCH_FCF(10);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-ieee80211.c |
| |
181 | #define FETCH_FCF(off) (wlan_broken_fc ? \ |
182 | BSWAP16(tvb_get_letohs(tvb, off)) : \ |
183 | tvb_get_letohs(tvb, off)) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/pint.h |
| |
105 | #define BSWAP16(x) \ |
106 | ((((x)&0xFF00)>>8) | \ |
107 | (((x)&0x00FF)<<8)) |
| |
|
| 6122 | | | else |
| 6123 | | | ctrl_fcf = 0; |
| 6124 | | | |
| 6125 | | | if () |
Event 8:
Taking false branch. evaluates to false.
hide
|
|
| 6126 | | | hdr_len = DATA_LONG_HDR_LEN; |
| 6127 | | | else |
| 6128 | | | hdr_len = (fcf, ctrl_fcf, is_ht); |
| 6129 | | | ohdr_len = hdr_len; |
| 6130 | | | if (datapad) |
Event 9:
Taking true branch. datapad evaluates to true.
hide
|
|
| 6131 | | | hdr_len = roundup2(hdr_len, 4);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-ieee80211.c |
| |
89 | #define roundup2(x, y) (((x)+((y)-1))&(~((y)-1))) /* if y is powers of two */ |
| |
|
| 6132 | | | |
| 6133 | | | fts_str = val_to_str(frame_type_subtype, frame_type_subtype_vals, |
| 6134 | | | "Unrecognized (Reserved frame)"); |
| 6135 | | | if (check_col (pinfo->cinfo, COL_INFO)) |
Event 10:
Taking true branch. check_col(...) evaluates to true.
hide
|
|
| 6136 | | | col_set_str (pinfo->cinfo, COL_INFO, fts_str); |
| 6137 | | | |
| 6138 | | | |
| 6139 | | | flags = FCF_FLAGS (fcf); |
| 6140 | | | more_frags = HAVE_FRAGMENTS (flags); |
| 6141 | | | |
| 6142 | | | for (i = 0; i < 8; i++) { |
| 6143 | | | if (! (flags & 0x80 >> i)) { |
| 6144 | | | flag_str[i] = '.'; |
| 6145 | | | } |
| 6146 | | | } |
| 6147 | | | |
| 6148 | | | if (is_ht && IS_STRICTLY_ORDERED(flags) && |
Event 12:
Skipping " if". - is_ht evaluates to true.
- flags & 128 evaluates to true.
- (fcf & 12) >> 2 == 0 evaluates to false.
- (fcf & 12) >> 2 == 2 evaluates to true.
- frame_type_subtype & 8 evaluates to false.
hide
|
|
| 6149 | | | ((FCF_FRAME_TYPE(fcf) == MGT_FRAME) || (FCF_FRAME_TYPE(fcf) == DATA_FRAME && |
| 6150 | | | DATA_FRAME_IS_QOS(frame_type_subtype)))) { |
| 6151 | | | htc_len = 4; |
| 6152 | | | } |
| 6153 | | | |
| 6154 | | | |
| 6155 | | | if (tree) |
Event 13:
Skipping " if". tree evaluates to false.
hide
|
|
| 6156 | | | { |
| 6157 | | | ti = proto_tree_add_protocol_format (tree, proto_wlan, tvb, 0, hdr_len, |
| 6158 | | | "IEEE 802.11 %s", fts_str); |
| 6159 | | | hdr_tree = proto_item_add_subtree (ti, ett_80211); |
| 6160 | | | |
| 6161 | | | dissect_frame_control(hdr_tree, tvb, wlan_broken_fc, 0); |
| 6162 | | | |
| 6163 | | | if (frame_type_subtype == CTRL_PS_POLL) |
| 6164 | | | proto_tree_add_uint(hdr_tree, hf_assoc_id,tvb,2,2, |
| 6165 | | | ASSOC_ID(tvb_get_letohs(tvb,2))); |
| 6166 | | | |
| 6167 | | | else |
| 6168 | | | proto_tree_add_uint (hdr_tree, hf_did_duration, tvb, 2, 2, |
| 6169 | | | tvb_get_letohs (tvb, 2)); |
| 6170 | | | } |
| 6171 | | | |
| 6172 | | | |
| 6173 | | | |
| 6174 | | | |
| 6175 | | | |
| 6176 | | | seq_control = 0; |
| 6177 | | | frag_number = 0; |
| 6178 | | | seq_number = 0; |
| 6179 | | | |
| 6180 | | | switch (FCF_FRAME_TYPE (fcf)) |
Event 14:
(fcf & 12) >> 2 evaluates to implicit-default.
hide
|
|
| 6181 | | | { |
| 6182 | | | |
| 6183 | | | case MGT_FRAME: |
| 6184 | | | |
| 6185 | | | |
| 6186 | | | |
| 6187 | | | src = tvb_get_ptr (tvb, 10, 6); |
| 6188 | | | dst = tvb_get_ptr (tvb, 4, 6); |
| 6189 | | | |
| 6190 | | | SET_ADDRESS(&pinfo->dl_src, AT_ETHER, 6, src);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/address.h |
| |
66 | #define SET_ADDRESS(addr, addr_type, addr_len, addr_data) { \ |
67 | (addr)->type = (addr_type); \ |
68 | (addr)->len = (addr_len); \ |
69 | (addr)->data = (addr_data); \ |
70 | } |
| |
|
| 6191 6638 |  | | [ Lines 6191 to 6638 omitted. ] |
| 6639 | | | PROTO_ITEM_SET_HIDDEN(hidden_item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
319 | #define PROTO_ITEM_SET_HIDDEN(proto_item) \ |
320 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_HIDDEN) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
| 6640 | | | hidden_item = proto_tree_add_ether (hdr_tree, hf_addr, tvb, 24, 6, src); |
| 6641 | | | PROTO_ITEM_SET_HIDDEN(hidden_item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
319 | #define PROTO_ITEM_SET_HIDDEN(proto_item) \ |
320 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_HIDDEN) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
| 6642 | | | break; |
| 6643 | | | } |
| 6644 | | | |
| 6645 | | | } |
| 6646 | | | break; |
| 6647 | | | } |
| 6648 | | | |
| 6649 | | | len = tvb_length_remaining(tvb, hdr_len); |
| 6650 | | | reported_len = tvb_reported_length_remaining(tvb, hdr_len); |
| 6651 | | | |
| 6652 | | | switch (fcs_len) |
Event 15:
fcs_len evaluates to 0.
hide
|
|
| 6653 | | | { |
| 6654 | | | case 0: |
| 6655 | | | has_fcs = FALSE; |
| 6656 | | | break; |
| 6657 | | | |
| 6658 | | | case 4: |
| 6659 | | | has_fcs = TRUE; |
| 6660 | | | break; |
| 6661 | | | |
| 6662 | | | default: |
| 6663 | | | has_fcs = wlan_check_fcs; |
| 6664 | | | break; |
| 6665 | | | } |
| 6666 | | | if (has_fcs) |
Event 16:
Taking false branch. has_fcs evaluates to false.
hide
|
|
| 6667 | | | { |
| 6668 | | | |
| 6669 | | | |
| 6670 | | | |
| 6671 | | | |
| 6672 | | | |
| 6673 | | | if (reported_len < 4) |
| 6674 | | | { |
| 6675 | | | |
| 6676 | | | |
| 6677 6739 |  | | [ Lines 6677 to 6739 omitted. ] |
| 6740 | | | fcs_good); |
| 6741 | | | PROTO_ITEM_SET_GENERATED(fcs_item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
325 | #define PROTO_ITEM_SET_GENERATED(proto_item) \ |
326 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_GENERATED) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
| 6742 | | | |
| 6743 | | | fcs_item = proto_tree_add_boolean(fcs_tree, |
| 6744 | | | hf_fcs_bad, tvb, |
| 6745 | | | hdr_len + len, 4, |
| 6746 | | | fcs_bad); |
| 6747 | | | PROTO_ITEM_SET_GENERATED(fcs_item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
325 | #define PROTO_ITEM_SET_GENERATED(proto_item) \ |
326 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_GENERATED) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
| 6748 | | | } |
| 6749 | | | } |
| 6750 | | | } else { |
| 6751 | | | flag_str[8] = '\0'; |
| 6752 | | | } |
| 6753 | | | |
| 6754 | | | proto_item_append_text(ti, ", Flags: %s", flag_str); |
| 6755 | [+] | | if (check_col (pinfo->cinfo, COL_INFO)) |
 |
| 6756 | | | col_append_fstr (pinfo->cinfo, COL_INFO, ", Flags=%s", flag_str); |
| 6757 | | | |
| 6758 | | | |
| 6759 | | | |
| 6760 | | | |
| 6761 | | | |
| 6762 | | | |
| 6763 | | | switch (FCF_FRAME_TYPE (fcf)) |
Event 20:
(fcf & 12) >> 2 evaluates to 2.
hide
|
|
| 6764 | | | { |
| 6765 | | | |
| 6766 | | | case MGT_FRAME: |
| 6767 | | | if (htc_len == 4) { |
| 6768 | | | dissect_ht_control(hdr_tree, tvb, ohdr_len - 4); |
| 6769 | | | } |
| 6770 | | | break; |
| 6771 | | | |
| 6772 | | | case DATA_FRAME: |
| 6773 | | | if (tree && DATA_FRAME_IS_QOS(frame_type_subtype)) |
Event 21:
Skipping " if". tree evaluates to false.
hide
|
|
| 6774 | | | { |
| 6775 | | | proto_item *qos_fields; |
| 6776 | | | proto_tree *qos_tree; |
| 6777 | | | |
| 6778 | | | guint16 qosoff; |
| 6779 | | | guint16 qos_control; |
| 6780 | | | guint16 qos_priority; |
| 6781 | | | guint16 qos_ack_policy; |
| 6782 | | | guint16 qos_amsdu_present; |
| 6783 | | | guint16 qos_eosp; |
| 6784 6925 |  | | [ Lines 6784 to 6925 omitted. ] |
| 6926 | | | |
| 6927 | | | if (htc_len == 4) { |
| 6928 | | | dissect_ht_control(hdr_tree, tvb, ohdr_len - 4); |
| 6929 | | | } |
| 6930 | | | } |
| 6931 | | | |
| 6932 | | | #ifdef HAVE_AIRPDCAP |
| 6933 | | | |
| 6934 | | | |
| 6935 | | | |
| 6936 | | | if (enable_decryption && !pinfo->fd->flags.visited) { |
| 6937 | | | const guint8 *enc_data = tvb_get_ptr(tvb, 0, hdr_len+reported_len); |
| 6938 | | | AirPDcapPacketProcess(&airpdcap_ctx, enc_data, hdr_len, hdr_len+reported_len, NULL, 0, NULL, TRUE, FALSE); |
Event 23:
!0 evaluates to true.
hide
|
|
| 6939 | | | } |
| 6940 | | | |
| 6941 | | | #endif |
| 6942 | | | |
| 6943 | | | |
| 6944 | | | |
| 6945 | | | |
| 6946 | | | if (DATA_FRAME_IS_NULL(frame_type_subtype)) |
Event 24:
Skipping " if". frame_type_subtype & 4 evaluates to false.
hide
|
|
| 6947 | | | return; |
| 6948 | | | |
| 6949 | | | if (!wlan_subdissector) { |
Event 25:
Taking true branch. wlan_subdissector evaluates to false.
hide
|
|
| 6950 | | | guint fnum = 0; |
| 6951 | | | |
| 6952 | | | |
| 6953 | | | |
| 6954 | | | |
| 6955 | | | retransmitted = FALSE; |
| 6956 | | | if(!pinfo->fd->flags.visited){ |
Event 26:
Taking true branch. pinfo->fd->flags.visited evaluates to false.
hide
|
|
| 6957 | | | retransmit_key key; |
| 6958 | | | retransmit_key *result; |
| 6959 | | | |
| 6960 | | | memcpy(key.bssid, bssid, 6); |
Event 27:
bssid, which evaluates to NULL, is passed to memcpy() as the second argument. See related event 1.
hide
Null Pointer Dereference
The body of memcpy() dereferences bssid, but it is NULL. The issue can occur if the highlighted code executes. See related event 27. Show: All events | Only primary events |
|
| |