(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smb.c) |
| |
| 14946 | | | dissect_transaction_response(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, proto_tree *smb_tree _U_) |
| 14947 | | | { |
| 14948 | | | guint8 sc, wc; |
| 14949 | | | guint16 od=0, po=0, pc=0, pd=0, dc=0, dd=0, td=0, tp=0; |
| 14950 | | | smb_info_t *si; |
| 14951 | | | smb_transact2_info_t *t2i = NULL; |
| 14952 | | | guint16 bc; |
| 14953 | | | int padcnt; |
| 14954 | | | gboolean dissected_trans; |
| 14955 | | | fragment_data *r_fd = NULL; |
| 14956 | | | tvbuff_t *pd_tvb=NULL, *d_tvb=NULL, *p_tvb=NULL; |
| 14957 | | | tvbuff_t *s_tvb=NULL, *sp_tvb=NULL; |
| 14958 | | | gboolean save_fragmented; |
| 14959 | | | proto_item *item; |
| 14960 | | | |
| 14961 | | | si = (smb_info_t *)pinfo->private_data; |
| 14962 | | | DISSECTOR_ASSERT(si);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
117 | #define DISSECTOR_ASSERT(expression) \ |
118 | ((void) ((expression) ? (void)0 : \ |
119 | __DISSECTOR_ASSERT (expression, __FILE__, __LINE__))) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
138 | #define __DISSECTOR_ASSERT(expression, file, lineno) \ |
139 | (REPORT_DISSECTOR_BUG( \ |
140 | ep_strdup_printf("%s:%u: failed assertion \"%s\"", \ |
141 | file, lineno, __DISSECTOR_ASSERT_STRINGIFY(expression)))) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
106 | #define REPORT_DISSECTOR_BUG(message) \ |
107 | ((getenv("WIRESHARK_ABORT_ON_DISSECTOR_BUG") != NULL) ? \ |
108 | abort() : \ |
109 | THROW_MESSAGE(DissectorError, message)) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/exceptions.h |
| |
226 | #define THROW_MESSAGE(x, y) \ |
227 | except_throw(XCEPT_GROUP_WIRESHARK, (x), (y)) |
| |
|
Event 1:
si evaluates to true.
hide
|
|
| 14963 | | | |
| 14964 | | | switch(si->cmd){ |
Event 2:
si->cmd evaluates to implicit-default.
hide
|
|
| 14965 | | | case SMB_COM_TRANSACTION2: |
| 14966 | | | |
| 14967 | | | if (si->sip != NULL && si->sip-> == SMB_EI_T2I) { |
| 14968 | | | t2i = si->sip->; |
| 14969 | | | } else |
| 14970 | | | t2i = NULL; |
| 14971 | | | if (t2i == NULL) { |
| 14972 | | | |
| 14973 | | | |
| 14974 | | | |
| 14975 15027 |  | | [ Lines 14975 to 15027 omitted. ] |
| 15028 | | | col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", |
| 15029 | | | val_to_str(t2i->subcmd, |
| 15030 | | | trans2_cmd_vals, |
| 15031 | | | "<unknown (0x%02x)>")); |
| 15032 | | | } |
| 15033 | | | } |
| 15034 | | | } |
| 15035 | | | break; |
| 15036 | | | } |
| 15037 | | | |
| 15038 | | | WORD_COUNT;
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smb.c |
| |
784 | #define WORD_COUNT \ |
785 | /* Word Count */ \ |
786 | wc = tvb_get_guint8(tvb, offset); \ |
787 | proto_tree_add_uint(tree, hf_smb_word_count, \ |
788 | tvb, offset, 1, wc); \ |
789 | offset += 1; \ |
790 | if(wc==0) goto bytecount; |
| |
|
Event 3:
Taking true branch. wc == 0 evaluates to true.
hide
|
|
| 15039 | | | |
| 15040 | | | |
| 15041 | | | tp = tvb_get_letohs(tvb, offset); |
| 15042 | | | proto_tree_add_uint(tree, hf_smb_total_param_count, tvb, offset, 2, tp); |
| 15043 | | | offset += 2; |
| 15044 | | | |
| 15045 | | | |
| 15046 | | | td = tvb_get_letohs(tvb, offset); |
| 15047 | | | proto_tree_add_uint(tree, hf_smb_total_data_count, tvb, offset, 2, td); |
| 15048 | | | offset += 2; |
| 15049 15098 |  | | [ Lines 15049 to 15098 omitted. ] |
| 15099 | | | s_tvb = tvb_new_subset(tvb, offset, 2*sc, 2*sc); |
| 15100 | | | } |
| 15101 | | | sp_tvb = tvb_new_subset(tvb, offset, -1, -1); |
| 15102 | | | } else { |
| 15103 | | | s_tvb = NULL; |
| 15104 | | | sp_tvb=NULL; |
| 15105 | | | } |
| 15106 | | | offset += 2*sc; |
| 15107 | | | |
| 15108 | | | |
| 15109 | [+] | | BYTE_COUNT;
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smb.c |
| |
792 | #define BYTE_COUNT \ |
793 | bytecount: \ |
794 | bc = tvb_get_letohs(tvb, offset); \ |
795 | proto_tree_add_uint(tree, hf_smb_byte_count, \ |
796 | tvb, offset, 2, bc); \ |
797 | offset += 2; \ |
798 | if(bc==0) goto endofcommand; |
| |
|
 |
| 15110 | | | |
| 15111 | | | |
| 15112 | | | |
| 15113 | | | |
| 15114 | | | |
| 15115 | | | |
| 15116 | | | save_fragmented = pinfo->fragmented; |
| 15117 | | | |
| 15118 | | | if( (td!=dc) || (tp!=pc) ){ |
Event 5:
Skipping " if". - td != dc evaluates to false.
- tp != pc evaluates to false.
hide
|
|
| 15119 | | | |
| 15120 | | | |
| 15121 | | | |
| 15122 | | | pinfo->fragmented = TRUE; |
| 15123 | | | if(smb_trans_reassembly){ |
| 15124 | | | |
| 15125 | | | if(pc && (tvb_length_remaining(tvb, po)>=pc) ){ |
| 15126 | | | r_fd = smb_trans_defragment(tree, pinfo, tvb, |
| 15127 | | | po, pc, pd, td+tp); |
| 15128 | | | |
| 15129 | | | } |
| 15130 | | | if((r_fd==NULL) && dc && (tvb_length_remaining(tvb, od)>=dc) ){ |
| 15131 | | | r_fd = smb_trans_defragment(tree, pinfo, tvb, |
| 15132 | | | od, dc, dd+tp, td+tp); |
| 15133 | | | } |
| 15134 | | | } |
| 15135 | | | } |
| 15136 | | | |
| 15137 | | | |
| 15138 | | | |
| 15139 | | | |
| 15140 | | | if(r_fd){ |
Event 6:
Skipping " if". r_fd evaluates to false.
hide
|
|
| 15141 | | | proto_item *frag_tree_item; |
| 15142 | | | |
| 15143 | | | pd_tvb = tvb_new_real_data(r_fd->data, r_fd->datalen, |
| 15144 | | | r_fd->datalen); |
| 15145 | | | tvb_set_child_real_data_tvbuff(tvb, pd_tvb); |
| 15146 | | | add_new_data_source(pinfo, pd_tvb, "Reassembled SMB"); |
| 15147 | | | show_fragment_tree(r_fd, &smb_frag_items, tree, pinfo, pd_tvb, &frag_tree_item); |
| 15148 | | | } |
| 15149 | | | |
| 15150 | | | |
| 15151 | | | if(pd_tvb){ |
Event 7:
Taking false branch. pd_tvb evaluates to false.
hide
|
|
| 15152 | | | |
| 15153 | | | if(tp){ |
| 15154 | | | p_tvb = tvb_new_subset(pd_tvb, 0, tp, tp); |
| 15155 | | | } |
| 15156 | | | if(td){ |
| 15157 | | | d_tvb = tvb_new_subset(pd_tvb, tp, td, td); |
| 15158 | | | } |
| 15159 | | | } else { |
| 15160 | | | |
| 15161 | | | |
| 15162 | | | |
| 15163 | | | |
| 15164 | | | |
| 15165 | | | if( (pd==0) && (dd==0) ){ |
| 15166 | | | int min; |
| 15167 | | | int reported_min; |
| 15168 | | | min = MIN(pc,tvb_length_remaining(tvb,po));
x /usr/include/glib-2.0/glib/gmacros.h |
| |
201 | #define MIN(a, b) (((a) < (b)) ? (a) : (b)) |
| |
|
Event 9:
pc < tvb_length_remaining(...) evaluates to false.
hide
|
|
| 15169 | | | reported_min = MIN(pc,tvb_reported_length_remaining(tvb,po));
x /usr/include/glib-2.0/glib/gmacros.h |
| |
201 | #define MIN(a, b) (((a) < (b)) ? (a) : (b)) |
| |
|
Event 10:
pc < tvb_reported_length_remaining(...) evaluates to true.
hide
|
|
| 15170 | | | if(min && reported_min) { |
Event 11:
Skipping " if". - min evaluates to true.
- reported_min evaluates to false.
hide
|
|
| 15171 | | | p_tvb = tvb_new_subset(tvb, po, min, reported_min); |
| 15172 | | | } |
| 15173 | | | min = MIN(dc,tvb_length_remaining(tvb,od));
x /usr/include/glib-2.0/glib/gmacros.h |
| |
201 | #define MIN(a, b) (((a) < (b)) ? (a) : (b)) |
| |
|
Event 12:
dc < tvb_length_remaining(...) evaluates to false.
hide
|
|
| 15174 | | | reported_min = MIN(dc,tvb_reported_length_remaining(tvb,od));
x /usr/include/glib-2.0/glib/gmacros.h |
| |
201 | #define MIN(a, b) (((a) < (b)) ? (a) : (b)) |
| |
|
Event 13:
dc < tvb_reported_length_remaining(...) evaluates to false.
hide
|
|
| 15175 | | | if(min && reported_min) { |
| 15176 | [+] | | d_tvb = tvb_new_subset(tvb, od, min, reported_min); |
 |
| 15177 | | | } |
| 15178 | | | |
| 15179 | | | |
| 15180 | | | |
| 15181 | | | |
| 15182 | | | |
| 15183 | | | if (tvb_length_remaining(tvb, po)){ |
Event 17:
Taking true branch. tvb_length_remaining(tvb, po) evaluates to true.
hide
|
|
| 15184 | | | pd_tvb = tvb_new_subset(tvb, po, -1, -1); |
| 15185 | | | } |
| 15186 | | | } |
| 15187 | | | } |
| 15188 | | | |
| 15189 | | | |
| 15190 | | | |
| 15191 | | | |
| 15192 | | | if(po>offset){ |
Event 18:
Taking true branch. po > offset evaluates to true.
hide
|
|
| 15193 | | | |
| 15194 | | | |
| 15195 | | | padcnt = po-offset; |
| 15196 | | | if (padcnt > bc) |
Event 19:
Skipping " if". padcnt > bc evaluates to false.
hide
|
|
| 15197 | | | padcnt = bc; |
| 15198 | | | proto_tree_add_item(tree, hf_smb_padding, tvb, offset, padcnt, TRUE); |
Event 20:
!0 evaluates to true.
hide
|
|
| 15199 | | | COUNT_BYTES(padcnt);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smb.c |
| |
803 | #define COUNT_BYTES(len) {\ |
804 | int tmp; \ |
805 | tmp=len; \ |
806 | offset += tmp; \ |
807 | bc -= tmp; \ |
808 | } |
| |
|
| 15200 | | | } |
| 15201 | | | if(si->cmd==SMB_COM_TRANSACTION2 && p_tvb){ |
Event 21:
Skipping " if". si->cmd == 50 evaluates to false.
hide
|
|
| 15202 | | | |
| 15203 | | | dissect_transaction2_response_parameters(p_tvb, pinfo, tree); |
| 15204 | | | } |
| 15205 | | | COUNT_BYTES(pc);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smb.c |
| |
803 | #define COUNT_BYTES(len) {\ |
804 | int tmp; \ |
805 | tmp=len; \ |
806 | offset += tmp; \ |
807 | bc -= tmp; \ |
808 | } |
| |
|
| 15206 | | | |
| 15207 | | | |
| 15208 | | | |
| 15209 | | | if(od>offset){ |
Event 22:
Taking true branch. od > offset evaluates to true.
hide
|
|
| 15210 | | | |
| 15211 | | | |
| 15212 | | | padcnt = od-offset; |
| 15213 | | | if (padcnt > bc) |
Event 23:
Taking true branch. padcnt > bc evaluates to true.
hide
|
|
| 15214 | | | padcnt = bc; |
| 15215 | | | proto_tree_add_item(tree, hf_smb_padding, tvb, offset, padcnt, TRUE); |
Event 24:
!0 evaluates to true.
hide
|
|
| 15216 | | | COUNT_BYTES(padcnt);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smb.c |
| |
803 | #define COUNT_BYTES(len) {\ |
804 | int tmp; \ |
805 | tmp=len; \ |
806 | offset += tmp; \ |
807 | bc -= tmp; \ |
808 | } |
| |
|
| 15217 | | | } |
| 15218 | | | |
| 15219 | | | |
| 15220 | | | |
| 15221 | | | |
| 15222 | | | |
| 15223 | | | if (dc > bc) |
Event 25:
Skipping " if". dc > bc evaluates to false.
hide
|
|
| 15224 | | | dc = bc; |
| 15225 | | | COUNT_BYTES(dc);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smb.c |
| |
803 | #define COUNT_BYTES(len) {\ |
804 | int tmp; \ |
805 | tmp=len; \ |
806 | offset += tmp; \ |
807 | bc -= tmp; \ |
808 | } |
| |
|
| 15226 | | | |
| 15227 | | | |
| 15228 | | | |
| 15229 | | | |
| 15230 | | | |
| 15231 | | | |
| 15232 | | | |
| 15233 | | | |
| 15234 | | | |
| 15235 | | | if(si->cmd==SMB_COM_TRANSACTION2 && d_tvb){ |
Event 26:
Skipping " if". si->cmd == 50 evaluates to false.
hide
|
|
| 15236 | | | |
| 15237 | | | dissect_transaction2_response_data(d_tvb, pinfo, tree); |
| 15238 | | | } |
| 15239 | | | |
| 15240 | | | |
| 15241 | | | if(si->cmd==SMB_COM_TRANSACTION){ |
Event 27:
Taking true branch. si->cmd == 37 evaluates to true.
hide
|
|
| 15242 | | | smb_transact_info_t *tri; |
| 15243 | | | |
| 15244 | | | dissected_trans = FALSE; |
| 15245 | | | if (si->sip != NULL && si->sip-> == SMB_EI_TRI) |
| 15246 | | | tri = si->sip->; |
| 15247 | | | else |
| 15248 | | | tri = NULL; |
| 15249 | | | if (tri != NULL) { |
Event 29:
Taking true branch. tri != (void *)0 evaluates to true.
hide
|
|
| 15250 | | | switch(tri->subcmd){ |
Event 30:
tri->subcmd evaluates to 1.
hide
|
|
| 15251 | | | |
| 15252 | | | case TRANSACTION_PIPE: |
| 15253 | | | |
| 15254 | | | |
| 15255 | | | |
| 15256 | | | |
| 15257 | | | |
| 15258 | | | |
| 15259 | | | if( pd_tvb) { |
| 15260 | | | dissected_trans = dissect_pipe_smb( |
| 15261 | | | sp_tvb, s_tvb, pd_tvb, p_tvb, |
| 15262 | | | d_tvb, NULL, pinfo, top_tree); |
| 15263 | | | } |
| 15264 | | | break; |
| 15265 | | | |
| 15266 | | | case TRANSACTION_MAILSLOT: |
| 15267 | | | |
| 15268 | | | |
| 15269 | | | |
| 15270 | | | if(d_tvb){ |
Event 31:
Taking true branch. d_tvb evaluates to true.
hide
|
|
| 15271 | | | dissected_trans = dissect_mailslot_smb( |
| 15272 | | | sp_tvb, s_tvb, d_tvb, NULL, pinfo, |
Event 32:
NULL is passed to dissect_mailslot_smb() as the fourth argument. - Dereferenced later, causing the null pointer dereference.
hide
|
|
| 15273 | [+] | | top_tree); |
 |
| |