(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-kink.c) |
| |
| 326 | | | dissect_payload_kink_ap_req(packet_info *pinfo, tvbuff_t *tvb, int offset, proto_tree *tree){ |
| 327 | | | proto_tree *payload_kink_ap_req_tree; |
| 328 | | | proto_item *ti; |
| 329 | | | guint8 next_payload; |
| 330 | | | guint8 reserved; |
| 331 | | | guint payload_length; |
| 332 | | | guint16 krb_ap_req_length; |
| 333 | | | time_t timer; |
| 334 | | | struct tm *tp; |
| 335 | | | int start_payload_offset = 0; |
| 336 | | | |
| 337 | | | start_payload_offset = offset; |
| 338 | | | payload_length = tvb_get_ntohs(tvb, offset + TO_PAYLOAD_LENGTH); |
| 339 | | | |
| 340 | | | |
| 341 | | | ti = proto_tree_add_text(tree, tvb, offset, payload_length, "KINK_AP_REQ"); |
| 342 | | | payload_kink_ap_req_tree = proto_item_add_subtree(ti, ett_payload_kink_ap_req); |
| 343 | | | |
| 344 | | | next_payload = tvb_get_guint8(tvb, offset); |
| 345 | | | proto_tree_add_uint(payload_kink_ap_req_tree, hf_kink_next_payload, tvb, offset, 1, next_payload); |
| 346 | | | offset ++; |
| 347 | | | |
| 348 | | | reserved = tvb_get_guint8(tvb, offset); |
| 349 | | | proto_tree_add_text(payload_kink_ap_req_tree, tvb, offset, 1, "RESERVED: %u", reserved); |
| 350 | | | offset ++; |
| 351 | | | |
| 352 | | | if(payload_length <= ){ |
Event 1:
Taking true branch. payload_length <= 8 evaluates to true.
hide
|
|
| 353 | | | proto_tree_add_text(payload_kink_ap_req_tree, tvb, offset, 2, "This Payload Length is too small.: %u", payload_length); |
| 354 | | | } |
| 355 | | | else{ |
| 356 | | | proto_tree_add_text(payload_kink_ap_req_tree, tvb, offset, 2, "Payload Length: %u", payload_length); |
| 357 | | | } |
| 358 | | | offset += 2; |
| 359 | | | |
| 360 | | | |
| 361 | | | timer = tvb_get_ntohl(tvb, offset); |
| 362 | | | tp = gmtime(&timer); |
Event 2:
gmtime() returns NULL. - Dereferenced later, causing the null pointer dereference.
hide
Event 3:
tp is set to gmtime(&timer), which evaluates to NULL. See related event 2.
hide
|
|
| 363 | | | proto_tree_add_text(payload_kink_ap_req_tree, tvb, offset, 4, "EPOCH: month %u. day %u. year %u.%u.%u.%u by UTC", |
| 364 | | | (tp->tm_mon)+1, tp->tm_mday, (tp->tm_year)+1900, tp->tm_hour, tp->tm_min, tp->tm_sec); |
Null Pointer Dereference
tp is dereferenced here, but it is NULL. The issue can occur if the highlighted code executes. See related event 3. Show: All events | Only primary events |
|
| |