(/home/sate/Testcases/c/cve/wireshark-1.2.0/tap-iostat.c) |
| |
| 470 | | | register_io_tap(io_stat_t *io, int i, const char *filter) |
| 471 | | | { |
| 472 | | | GString *error_string; |
| 473 | | | const char *flt; |
| 474 | | | int j; |
| 475 | | | size_t namelen; |
| 476 | | | const char *p, *parenp; |
| 477 | | | char *field; |
| 478 | | | *hfi; |
| 479 | | | |
| 480 | | | io->items[i].prev=&io->items[i]; |
| 481 | | | io->items[i].next=NULL; |
| 482 | | | io->items[i].parent=io; |
| 483 | | | io->items[i].time=0; |
| 484 | | | io->items[i].calc_type=CALC_TYPE_BYTES; |
| 485 | | | io->items[i].frames=0; |
| 486 | | | io->items[i].counter=0; |
| 487 | | | io->items[i].num=0; |
| 488 | | | io->filters[i]=filter; |
| 489 | | | flt=filter; |
| 490 | | | |
| 491 | | | if(!filter){ |
Event 1:
Skipping " if". filter evaluates to true.
hide
|
|
| 492 | | | filter=""; |
| 493 | | | } |
| 494 | | | field=NULL; |
| 495 | | | hfi=NULL; |
Event 2:
hfi is set to NULL. - Dereferenced later, causing the null pointer dereference.
hide
|
|
| 496 | | | for(j=0; calc_type_table[j].func_name; j++){ |
Event 3:
Leaving loop. calc_type_table[j].func_name evaluates to false.
hide
|
|
| 497 | | | namelen=strlen(calc_type_table[j].func_name); |
| 498 | | | if(strncmp(filter, calc_type_table[j].func_name, namelen) == 0 |
| 499 | | | && *(filter+namelen)=='('){ |
| 500 | | | io->items[i].calc_type=calc_type_table[j].calc_type; |
| 501 | | | |
| 502 | | | p=filter+namelen+1; |
| 503 | | | parenp=strchr(p, ')'); |
| 504 | | | if(!parenp){ |
| 505 | | | fprintf(stderr, "tshark: Closing parenthesis missing from calculated expression.\n"); |
| 506 | | | exit(10); |
| 507 524 |  | | [ Lines 507 to 524 omitted. ] |
| 525 | | | fprintf(stderr, "tshark: There is no field named '%s'.\n", |
| 526 | | | field); |
| 527 | | | g_free(field); |
| 528 | | | exit(10); |
| 529 | | | } |
| 530 | | | |
| 531 | | | io->items[i].hf_index=hfi->id; |
| 532 | | | break; |
| 533 | | | } |
| 534 | | | } |
| 535 | | | if(io->items[i].calc_type!=CALC_TYPE_BYTES){ |
Event 4:
Taking true branch. io->items[i].calc_type != 0 evaluates to true.
hide
|
|
| 536 | | | |
| 537 | | | switch(hfi->type){ |
Null Pointer Dereference
hfi is dereferenced here, but it is NULL. The issue can occur if the highlighted code executes. See related event 2. Show: All events | Only primary events |
|
| |