(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-bacapp.c) |
| |
| 2766 | | | fBitStringTagVS (tvbuff_t *tvb, proto_tree *tree, guint offset, const gchar *label, |
| 2767 | | | const value_string *src) |
| 2768 | | | { |
| 2769 | | | guint8 tag_no, tag_info, tmp; |
| 2770 | | | gint j, unused, skip; |
| 2771 | | | guint start = offset; |
| 2772 | | | guint offs; |
| 2773 | | | guint32 lvt, i, numberOfBytes; |
| 2774 | | | guint8 bf_arr[256]; |
| 2775 | | | proto_tree* subtree = tree; |
| 2776 | | | proto_item* ti = 0; |
| 2777 | | | |
| 2778 | | | offs = (tvb, offset, &tag_no, &tag_info, &lvt); |
| 2779 | | | numberOfBytes = lvt-1; |
| 2780 | | | offset+=offs; |
| 2781 | | | unused = tvb_get_guint8(tvb, offset); |
| 2782 | | | ti = proto_tree_add_text(tree, tvb, start, offs+lvt, |
| 2783 | | | "%s(Bit String)", |
| 2784 | | | label); |
| 2785 | | | if (ti) { |
| 2786 | | | subtree = proto_item_add_subtree(ti, ett_bacapp_tag); |
| 2787 | | | } |
| 2788 | | | (tvb, subtree, start, &tag_no, &tag_info, &lvt); |
| 2789 | | | proto_tree_add_text(subtree, tvb, offset, 1, |
| 2790 | | | "Unused bits: %u", |
| 2791 | | | unused); |
| 2792 | | | skip = 0; |
| 2793 | | | for (i = 0; i < numberOfBytes; i++) { |
| 2794 | | | tmp = tvb_get_guint8(tvb, (offset)+i+1); |
| 2795 | | | if (i == numberOfBytes-1) { skip = unused; } |
| 2796 | | | for (j = 0; j < 8-skip; j++) { |
| 2797 | | | if (src != NULL) { |
| 2798 | | | if (tmp & (1 << (7 - j))) |
| 2799 | | | proto_tree_add_text(subtree, tvb, |
| 2800 | | | offset+i+1, 1, |
| 2801 | | | "%s = TRUE", |
| 2802 | | | val_to_str((guint) (i*8 +j), |
| 2803 | | | src, |
| 2804 | | | ASHRAE_Reserved_Fmt)); |
Format String
val_to_str() is being called with a format string that is not constant. The format string (third argument) may not match the other arguments to val_to_str(); this could lead to security or stability problems. val_to_str() is usually called with strings that look like format strings in this project. |
|
| 2805 | | | else |
| 2806 | | | proto_tree_add_text(subtree, tvb, |
| 2807 | | | offset+i+1, 1, |
| 2808 | | | "%s = FALSE", |
| 2809 | | | val_to_str((guint) (i*8 +j), |
| 2810 | | | src, |
| 2811 | | | ASHRAE_Reserved_Fmt)); |
| 2812 | | | } else { |
| 2813 | | | bf_arr[min(255,(i*8)+j)] = tmp & (1 << (7 - j)) ? '1' : '0'; |
| 2814 | | | } |
| 2815 | | | } |
| 2816 | | | } |
| 2817 | | | |
| 2818 | | | if (src == NULL) |
| 2819 | | | { |
| 2820 | | | bf_arr[min(255,numberOfBytes*8-unused)] = 0; |
| 2821 | | | proto_tree_add_text(subtree, tvb, offset, lvt, "B'%s'", bf_arr); |
| 2822 | | | } |
| 2823 | | | |
| 2824 | | | offset+=lvt; |
| 2825 | | | |
| 2826 | | | return offset; |
| 2827 | | | } |
| |