(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-gsm_a_bssmap.c) |
| |
| 5582 | | | dissect_bssmap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) |
| 5583 | | | { |
| 5584 | | | static gsm_a_tap_rec_t tap_rec[4]; |
| 5585 | | | static gsm_a_tap_rec_t *tap_p; |
| 5586 | | | static guint tap_current=0; |
| 5587 | | | guint8 oct; |
| 5588 | | | guint32 offset, saved_offset; |
| 5589 | | | guint32 len; |
| 5590 | | | gint idx; |
| 5591 | | | proto_item *bssmap_item = NULL; |
| 5592 | | | proto_tree *bssmap_tree = NULL; |
| 5593 | | | const gchar *str; |
| 5594 | | | sccp_msg_info_t* sccp_msg; |
| 5595 | | | |
| 5596 | | | sccp_msg = pinfo->sccp_info; |
| 5597 | | | |
| 5598 | | | if (!(sccp_msg && sccp_msg->data.co.assoc)) { |
Event 1:
Skipping " if". - sccp_msg evaluates to true.
- sccp_msg->data.co.assoc evaluates to true.
hide
|
|
| 5599 | | | sccp_msg = NULL; |
| 5600 | | | } |
| 5601 | | | |
| 5602 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
Event 3:
Skipping " if". check_col(...) evaluates to false.
hide
|
|
| 5603 | | | { |
| 5604 | | | col_append_str(pinfo->cinfo, COL_INFO, "(BSSMAP) "); |
| 5605 | | | } |
| 5606 | | | |
| 5607 | | | |
| 5608 | | | |
| 5609 | | | |
| 5610 | | | tap_current++; |
| 5611 | | | if (tap_current >= 4) |
Event 4:
Skipping " if". tap_current >= 4 evaluates to false.
hide
|
|
| 5612 | | | { |
| 5613 | | | tap_current = 0; |
| 5614 | | | } |
| 5615 | | | tap_p = &tap_rec[tap_current]; |
| 5616 | | | |
| 5617 | | | |
| 5618 | | | offset = 0; |
| 5619 | | | saved_offset = offset; |
| 5620 | | | |
| 5621 | | | g_pinfo = pinfo; |
| 5622 | | | g_tree = tree; |
| 5623 | | | |
| 5624 | | | len = tvb_length(tvb); |
| 5625 | | | |
| 5626 | | | |
| 5627 | | | |
| 5628 | | | |
| 5629 | | | oct = tvb_get_guint8(tvb, offset++); |
| 5630 | | | |
| 5631 | | | str = match_strval_idx((guint32) oct, gsm_a_bssmap_msg_strings, &idx); |
| 5632 | | | |
| 5633 | | | if (sccp_msg && !sccp_msg->data.co.label) { |
Null Test After Dereference
This code tests the nullness of sccp_msg, which has already been dereferenced. - If sccp_msg were null, there would have been a prior null pointer dereference at packet-gsm_a_bssmap.c:5598, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 2. Show: All events | Only primary events |
|
| 5634 | | | sccp_msg->data.co.label = se_strdup(val_to_str((guint32) oct, gsm_a_bssmap_msg_strings, "BSSMAP (0x%02x)")); |
| 5635 | | | } |
| 5636 | | | |
| 5637 | | | |
| 5638 | | | |
| 5639 | | | |
| 5640 | | | if (str == NULL) |
| 5641 | | | { |
| 5642 | | | bssmap_item = |
| 5643 | | | proto_tree_add_protocol_format(tree, proto_a_bssmap, tvb, 0, len, |
| 5644 | | | "GSM A-I/F BSSMAP - Unknown BSSMAP Message Type (0x%02x)", |
| 5645 | | | oct); |
| 5646 | | | |
| 5647 | | | bssmap_tree = proto_item_add_subtree(bssmap_item, ett_bssmap_msg); |
| 5648 | | | } |
| 5649 | | | else |
| 5650 | | | { |
| 5651 | | | bssmap_item = |
| 5652 | | | proto_tree_add_protocol_format(tree, proto_a_bssmap, tvb, 0, -1, |
| 5653 | | | "GSM A-I/F BSSMAP - %s", |
| 5654 | | | str); |
| 5655 | | | |
| 5656 | | | bssmap_tree = proto_item_add_subtree(bssmap_item, ett_gsm_bssmap_msg[idx]); |
| 5657 | | | |
| 5658 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
| 5659 | | | { |
| 5660 | | | col_append_fstr(pinfo->cinfo, COL_INFO, "%s ", str); |
| 5661 | | | } |
| 5662 | | | |
| 5663 | | | |
| 5664 | | | |
| 5665 | | | |
| 5666 | | | proto_tree_add_uint_format(bssmap_tree, hf_gsm_a_bssmap_msg_type, |
| 5667 | | | tvb, saved_offset, 1, oct, "Message Type %s",str); |
| 5668 | | | } |
| 5669 | | | |
| 5670 | | | tap_p->pdu_type = BSSAP_PDU_TYPE_BSSMAP; |
| 5671 | | | tap_p->message_type = oct; |
| 5672 | | | |
| 5673 | | | tap_queue_packet(gsm_a_tap, pinfo, tap_p); |
| 5674 | | | |
| 5675 | | | if (str == NULL) return; |
| 5676 | | | |
| 5677 | | | if ((len - offset) <= 0) return; |
| 5678 | | | |
| 5679 | | | |
| 5680 | | | |
| 5681 | | | |
| 5682 | | | if (bssmap_msg_fcn[idx] == NULL) |
| 5683 | | | { |
| 5684 | | | proto_tree_add_text(bssmap_tree, |
| 5685 | | | tvb, offset, len - offset, |
| 5686 | | | "Message Elements"); |
| 5687 | | | } |
| 5688 | | | else |
| 5689 | | | { |
| 5690 | | | (*bssmap_msg_fcn[idx])(tvb, bssmap_tree, offset, len - offset); |
| 5691 | | | } |
| 5692 | | | } |
| |