(/home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/profinet/packet-dcom-cba-acco.c) |
| |
| 1227 | | | dissect_ICBAAccoServer_Connect_rqst(tvbuff_t *tvb, int offset, |
| 1228 | | | packet_info *pinfo, proto_tree *tree, guint8 *drep) |
| 1229 | | | { |
| 1230 | | | guint16 u16QoSType; |
| 1231 | | | guint16 u16QoSValue; |
| 1232 | | | guint8 u8State; |
| 1233 | | | guint32 u32Count; |
| 1234 | | | guint32 u32ArraySize; |
| 1235 | | | |
| 1236 | | | guint32 u32VariableOffset; |
| 1237 | | | proto_item *sub_item; |
| 1238 | | | proto_tree *sub_tree; |
| 1239 | | | guint32 u32SubStart; |
| 1240 | | | guint32 u32Pointer; |
| 1241 | | | guint16 u16VarType; |
| 1242 | | | guint32 u32ConsID; |
| 1243 | | | gchar szItem[1000] = { 0 }; |
| 1244 | | | guint32 u32MaxItemLen = sizeof(szItem); |
| 1245 | | | gchar szCons[1000] = { 0 }; |
| 1246 | | | guint32 u32MaxConsLen = sizeof(szCons); |
| 1247 | | | guint32 u32Idx; |
| 1248 | | | proto_item *item; |
| 1249 | | | dcerpc_info *info = (dcerpc_info *)pinfo->private_data; |
| 1250 | | | dcom_interface_t *cons_interf; |
| 1251 | | | cba_ldev_t *cons_ldev; |
| 1252 | | | cba_ldev_t *prov_ldev; |
| 1253 | | | cba_connection_t *conn; |
| 1254 | | | server_connect_call_t *call; |
| 1255 | | | |
| 1256 | | | |
| 1257 | | | offset = dissect_dcom_this(tvb, offset, pinfo, tree, drep); |
| 1258 | | | |
| 1259 | | | |
| 1260 | | | prov_ldev = cba_ldev_find(pinfo, pinfo->net_dst.data, &info->call_data->object_uuid); |
| 1261 | | | |
| 1262 | | | item = proto_tree_add_boolean (tree, hf_cba_acco_dcom_call, tvb, offset, 0, TRUE); |
Event 1:
!0 evaluates to true.
hide
|
|
| 1263 | | | PROTO_ITEM_SET_GENERATED(item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
325 | #define PROTO_ITEM_SET_GENERATED(proto_item) \ |
326 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_GENERATED) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
Event 2:
item evaluates to false.
hide
|
|
| 1264 | | | pinfo->profinet_type = 2; |
| 1265 | | | |
| 1266 | | | offset = dissect_dcom_LPWSTR(tvb, offset, pinfo, tree, drep, |
| 1267 | | | hf_cba_acco_conn_consumer, szCons, u32MaxConsLen); |
| 1268 | | | |
| 1269 | | | |
| 1270 | [+] | | cons_ldev = cba_acco_add(pinfo, szCons); |
 |
| 1271 | | | |
| 1272 | | | offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, drep, |
| 1273 | | | hf_cba_acco_conn_qos_type, &u16QoSType); |
| 1274 | | | offset = dissect_dcom_WORD(tvb, offset, pinfo, tree, drep, |
| 1275 | | | hf_cba_acco_conn_qos_value, &u16QoSValue); |
| 1276 | | | offset = dissect_dcom_BYTE(tvb, offset, pinfo, tree, drep, |
| 1277 | | | hf_cba_acco_conn_state, &u8State); |
| 1278 | | | |
| 1279 | [+] | | offset = dissect_dcom_PMInterfacePointer(tvb, offset, pinfo, tree, drep, 0, &cons_interf); |
 |
| 1280 | | | if(cons_interf == NULL) { |
Event 17:
Skipping " if". cons_interf == (void *)0 evaluates to false.
hide
|
|
| 1281 | | | expert_add_info_format(pinfo, NULL, PI_UNDECODED, PI_NOTE, |
| 1282 | | | "Server_Connect: consumer interface invalid"); |
| 1283 | | | } |
| 1284 | | | |
| 1285 | | | |
| 1286 | | | if(cons_interf != NULL && cons_ldev != NULL) { |
Event 18:
Skipping " if". - cons_interf != (void *)0 evaluates to true.
- cons_ldev != (void *)0 evaluates to false.
hide
|
|
| 1287 | | | cba_ldev_link_acco(pinfo, cons_ldev, cons_interf); |
| 1288 | | | } |
| 1289 | | | |
| 1290 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, drep, |
| 1291 | | | hf_cba_acco_count, &u32Count); |
| 1292 | | | |
| 1293 | | | offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, drep, |
| 1294 | [+] | | &u32ArraySize); |
 |
| 1295 | | | |
| 1296 | | | |
| 1297 | | | if(prov_ldev != NULL && cons_ldev != NULL) { |
| 1298 | | | call = se_alloc(sizeof(server_connect_call_t) + u32ArraySize * sizeof(cba_connection_t *)); |
| 1299 | | | call->conn_count = 0; |
| 1300 | | | call->frame = NULL; |
| 1301 | | | call->conns = (cba_connection_t **) (call+1); |
| 1302 | | | info->call_data->private_data = call; |
| 1303 | | | } else{ |
| 1304 | | | call = NULL; |
| 1305 | | | } |
| 1306 | | | |
| 1307 | | | u32VariableOffset = offset + u32ArraySize*16; |
| 1308 | | | |
| 1309 | | | |
| 1310 | | | u32Idx = 1; |
| 1311 | | | while (u32ArraySize--) { |
Event 26:
Entering loop body. u32ArraySize-- evaluates to true.
hide
|
|
| 1312 | | | sub_item = proto_tree_add_item(tree, hf_cba_connectin, tvb, offset, 0, FALSE); |
| 1313 | | | sub_tree = proto_item_add_subtree(sub_item, ett_cba_connectin); |
| 1314 | | | u32SubStart = offset; |
| 1315 | | | |
| 1316 | | | |
| 1317 | | | offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, drep, |
| 1318 | [+] | | &u32Pointer); |
 |
| 1319 | | | if (u32Pointer) { |
Event 33:
Skipping " if". u32Pointer evaluates to false.
hide
|
|
| 1320 | | | u32VariableOffset = dissect_dcom_LPWSTR(tvb, u32VariableOffset, pinfo, sub_tree, drep, |
| 1321 | | | hf_cba_acco_conn_provider_item, szItem, u32MaxItemLen); |
| 1322 | | | } |
| 1323 | | | |
| 1324 | | | |
| 1325 | | | offset = dissect_dcom_VARTYPE(tvb, offset, pinfo, sub_tree, drep, |
| 1326 | | | &u16VarType); |
| 1327 | | | |
| 1328 | | | |
| 1329 | | | offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, drep, |
| 1330 | | | &u32Pointer); |
| 1331 | | | if (u32Pointer) { |
Event 34:
Taking true branch. u32Pointer evaluates to true.
hide
|
|
| 1332 | | | u32VariableOffset = dissect_dcom_VARIANT(tvb, u32VariableOffset, pinfo, sub_tree, drep, |
| 1333 | | | hf_cba_acco_conn_epsilon); |
| 1334 | | | } |
| 1335 | | | |
| 1336 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1337 | [+] | | hf_cba_acco_conn_cons_id, &u32ConsID); |
Event 35:
dissect_ndr_uint32() does not initialize u32ConsID. - This may be because of a failure case or other special case for dissect_ndr_uint32().
hide
|
|
 |
| 1338 | | | |
| 1339 | | | |
| 1340 | | | if(prov_ldev != NULL && cons_ldev != NULL) { |
| 1341 | | | conn = cba_connection_connect(pinfo, cons_ldev, prov_ldev, NULL, |
| 1342 | | | u16QoSType, u16QoSValue, szItem, u32ConsID, 0, |
| 1343 | | | |
| 1344 | | | se_memdup(&u16VarType, 2), 1); |
| 1345 | | | |
| 1346 | | | cba_connection_info(tvb, pinfo, sub_tree, conn); |
| 1347 | | | } else { |
| 1348 | | | conn = NULL; |
| 1349 | | | } |
| 1350 | | | |
| 1351 | | | |
| 1352 | | | if(call != NULL) { |
Event 38:
Skipping " if". call != (void *)0 evaluates to false.
hide
|
|
| 1353 | | | call->conn_count++; |
| 1354 | | | call->conns[u32Idx-1] = conn; |
| 1355 | | | } |
| 1356 | | | |
| 1357 | | | |
| 1358 | | | proto_item_append_text(sub_item, "[%u]: ConsID=0x%x, ProvItem=\"%s\", VarType=%s", |
| 1359 | | | u32Idx, u32ConsID, szItem, |
Uninitialized Variable
u32ConsID was not initialized. The issue can occur if the highlighted code executes. See related event 35. Show: All events | Only primary events |
|
| 1360 | | | val_to_str(u16VarType, dcom_variant_type_vals, "Unknown (0x%04x)") ); |
| |