(/home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/profinet/packet-dcom-cba-acco.c) |
| |
| 3714 | | | dissect_ICBAAccoMgt_GetIDs_resp(tvbuff_t *tvb, int offset, |
| 3715 | | | packet_info *pinfo, proto_tree *tree, guint8 *drep) |
| 3716 | | | { |
| 3717 | | | guint32 u32Count; |
| 3718 | | | guint32 u32Pointer; |
| 3719 | | | guint32 u32ArraySize; |
| 3720 | | | guint32 u32ConsID; |
| 3721 | | | guint8 u8State; |
| 3722 | | | guint16 u16Version; |
| 3723 | | | guint32 u32HResult; |
| 3724 | | | guint32 u32Idx; |
| 3725 | | | proto_item *sub_item; |
| 3726 | | | proto_tree *sub_tree; |
| 3727 | | | guint32 u32SubStart; |
| 3728 | | | |
| 3729 | | | |
| 3730 | | | offset = dissect_dcom_that(tvb, offset, pinfo, tree, drep); |
| 3731 | | | |
| 3732 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, drep, |
| 3733 | | | hf_cba_acco_count, &u32Count); |
| 3734 | | | |
| 3735 | [+] | | if (check_col(pinfo->cinfo, COL_INFO)) { |
 |
| 3736 | | | if (u32Count) { |
| 3737 | | | col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u ConsID=", u32Count); |
| 3738 | | | } else { |
| 3739 | | | col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u", u32Count); |
| 3740 | | | } |
| 3741 | | | } |
| 3742 | | | |
| 3743 | | | offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, drep, |
| 3744 | | | &u32Pointer); |
| 3745 | | | if (u32Pointer) { |
Event 3:
Taking true branch. u32Pointer evaluates to true.
hide
|
|
| 3746 | | | offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, drep, |
| 3747 | | | &u32ArraySize); |
| 3748 | | | |
| 3749 | | | u32Idx = 1; |
| 3750 | | | while (u32ArraySize--) { |
Event 4:
Entering loop body. u32ArraySize-- evaluates to true.
hide
|
|
| 3751 | | | sub_item = proto_tree_add_item(tree, hf_cba_getidout, tvb, offset, 0, FALSE); |
| 3752 | | | sub_tree = proto_item_add_subtree(sub_item, ett_cba_getidout); |
| 3753 | | | u32SubStart = offset; |
| 3754 | | | |
| 3755 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 3756 | | | hf_cba_acco_conn_cons_id, &u32ConsID); |
| 3757 | | | offset = dissect_dcom_BOOLEAN(tvb, offset, pinfo, sub_tree, drep, |
| 3758 | | | hf_cba_acco_conn_state, &u8State); |
| 3759 | | | offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, drep, |
| 3760 | [+] | | hf_cba_acco_conn_version, &u16Version); |
Event 5:
dissect_ndr_uint16() does not initialize u16Version. - This may be because of a failure case or other special case for dissect_ndr_uint16().
hide
|
|
 |
| 3761 | | | offset = dissect_dcom_indexed_HRESULT(tvb, offset, pinfo, sub_tree, drep, |
| 3762 | | | &u32HResult, u32Idx); |
| 3763 | | | |
| 3764 | | | proto_item_append_text(sub_item, "[%u]: ConsID=0x%x State=%s Version=%u %s", |
| 3765 | | | u32Idx, u32ConsID, |
| 3766 | | | val_to_str(u8State, cba_acco_conn_state_vals, "Unknown (0x%02x)"), |
| 3767 | | | u16Version, |
Uninitialized Variable
u16Version was not initialized. The issue can occur if the highlighted code executes. See related event 5. Show: All events | Only primary events |
|
| 3768 | | | val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") ); |
| |