(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-sigcomp.c) |
| |
| 986 | | | dissect_udvm_bytecode(tvbuff_t *udvm_tvb, proto_tree *sigcomp_udvm_tree,guint start_address) |
| 987 | | | { |
| 988 | | | guint instruction; |
| 989 | | | gint offset = 0; |
| 990 | | | gint start_offset; |
| 991 | | | gint len; |
| 992 | | | gint n; |
| 993 | | | guint instruction_no = 0; |
| 994 | | | guint16 value = 0; |
| 995 | | | proto_item *item, *item2; |
| 996 | | | guint UDVM_address = start_address; |
| 997 | | | gboolean is_memory_address; |
| 998 | [+] | | guint16 msg_length = tvb_reported_length_remaining(udvm_tvb, offset); |
 |
| 999 | | | |
| 1000 | | | |
| 1001 | | | while (msg_length > offset) { |
Event 5:
Entering loop body. msg_length > offset evaluates to true.
hide
|
|
| 1002 | [+] | | instruction = tvb_get_guint8(udvm_tvb, offset); |
 |
| 1003 | | | instruction_no ++; |
| 1004 | | | UDVM_address = start_address + offset; |
| 1005 | | | ; |
| 1006 | | | |
| 1007 | | | item = proto_tree_add_text(sigcomp_udvm_tree, udvm_tvb, offset, 1, |
| 1008 | | | "######### UDVM instruction %u at UDVM-address %u (0x%x) #########", |
| 1009 | | | instruction_no,UDVM_address,UDVM_address); |
| 1010 | | | PROTO_ITEM_SET_GENERATED(item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
325 | #define PROTO_ITEM_SET_GENERATED(proto_item) \ |
326 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_GENERATED) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
Event 20:
item evaluates to true.
hide
|
|
| 1011 | | | proto_tree_add_item(sigcomp_udvm_tree, hf_sigcomp_udvm_instr, udvm_tvb, offset, 1, FALSE); |
| 1012 | | | offset ++; |
| 1013 | | | switch ( instruction ) { |
Event 21:
instruction evaluates to 18.
hide
|
|
| 1014 | | | |
| 1015 | | | case SIGCOMP_INSTR_AND: |
| 1016 | | | |
| 1017 | | | offset = dissect_udvm_reference_operand(udvm_tvb, sigcomp_udvm_tree, offset, &start_offset, &value); |
| 1018 | | | len = offset - start_offset; |
| 1019 | | | proto_tree_add_uint(sigcomp_udvm_tree, hf_udvm_operand_1, |
| 1020 | | | udvm_tvb, start_offset, len, value); |
| 1021 | | | |
| 1022 | | | offset = dissect_udvm_multitype_operand(udvm_tvb, sigcomp_udvm_tree, offset, FALSE,&start_offset, &value, &is_memory_address); |
| 1023 | | | len = offset - start_offset; |
| 1024 1273 |  | | [ Lines 1024 to 1273 omitted. ] |
| 1274 | | | |
| 1275 | | | case SIGCOMP_INSTR_POP: |
| 1276 | | | |
| 1277 | | | offset = dissect_udvm_multitype_operand(udvm_tvb, sigcomp_udvm_tree, offset, TRUE, &start_offset, &value, &is_memory_address); |
| 1278 | | | |
| 1279 | | | len = offset - start_offset; |
| 1280 | | | proto_tree_add_uint(sigcomp_udvm_tree, hf_udvm_address, |
| 1281 | | | udvm_tvb, start_offset, len, value); |
| 1282 | | | break; |
| 1283 | | | |
| 1284 | | | case SIGCOMP_INSTR_COPY: |
| 1285 | | | |
| 1286 | [+] | | offset = dissect_udvm_multitype_operand(udvm_tvb, sigcomp_udvm_tree, offset, FALSE,&start_offset, &value, &is_memory_address); |
Event 22:
dissect_udvm_multitype_operand() does not initialize start_offset. - This may be because of a failure case or other special case for dissect_udvm_multitype_operand().
hide
|
|
 |
| 1287 | | | len = offset - start_offset; |
Uninitialized Variable
start_offset was not initialized. The issue can occur if the highlighted code executes. See related event 22. Show: All events | Only primary events |
|
| |