(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-x11.c) |
| |
| 2016 | | | static void listOfString8(tvbuff_t *tvb, int *offsetp, proto_tree *t, int hf, |
| 2017 | | | int hf_item, int length, gboolean little_endian) |
| 2018 | | | { |
| 2019 | | | char *s = NULL; |
Event 1:
s is set to NULL. - Dereferenced later, causing the null pointer dereference.
hide
|
|
| 2020 | | | guint allocated = 0; |
| 2021 | | | proto_item *ti; |
| 2022 | | | proto_tree *tt; |
| 2023 | | | int i; |
| 2024 | | | |
| 2025 | | | |
| 2026 | | | |
| 2027 | | | int scanning_offset = *offsetp; |
| 2028 | | | int l; |
| 2029 | | | for(i = length; i; i--) { |
Event 2:
Entering loop body. i evaluates to true.
hide
Event 3:
Continuing from loop body. Leaving loop. i evaluates to false.
hide
|
|
| 2030 | | | l = tvb_get_guint8(tvb, scanning_offset); |
| 2031 | | | scanning_offset += 1 + l; |
| 2032 | | | } |
| 2033 | | | |
| 2034 | | | ti = proto_tree_add_item(t, hf, tvb, *offsetp, scanning_offset - *offsetp, little_endian); |
| 2035 | | | tt = proto_item_add_subtree(ti, ett_x11_list_of_string8); |
| 2036 | | | |
| 2037 | | | while(length--) { |
Event 4:
Entering loop body. length-- evaluates to true.
hide
|
|
| 2038 | [+] | | unsigned l = VALUE8(tvb, *offsetp); |
 |
| 2039 | | | if (allocated < (l + 1)) { |
Event 9:
Skipping " if". allocated < l + 1 evaluates to false.
hide
|
|
| 2040 | | | s = ep_alloc(l + 1); |
| 2041 | | | allocated = l + 1; |
| 2042 | | | } |
| 2043 | [+] | | stringCopy(s, (gchar *)tvb_get_ptr(tvb, *offsetp + 1, l), l); |
Event 10:
s, which evaluates to NULL, is passed to stringCopy() as the first argument. See related event 1.
hide
|
|
 |
| |