(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dcom.c) |
| |
| 1912 | | | dissect_dcom_OBJREF(tvbuff_t *tvb, gint offset, packet_info *pinfo, |
| 1913 | | | proto_tree *tree, guint8 *drep, int hfindex, dcom_interface_t **interf) |
| 1914 | | | { |
| 1915 | | | guint32 u32Signature; |
| 1916 | | | guint32 u32Flags; |
| 1917 | | | e_uuid_t iid; |
| 1918 | | | e_uuid_t clsid; |
| 1919 | | | proto_item *sub_item; |
| 1920 | | | proto_tree *sub_tree; |
| 1921 | | | guint32 u32SubStart; |
| 1922 | | | guint32 u32CBExtension; |
| 1923 | | | guint32 u32Size; |
| 1924 | | | guint64 oxid; |
| 1925 | | | guint64 oid; |
| 1926 | | | e_uuid_t ipid; |
| 1927 | | | dcom_interface_t *dcom_if = NULL; |
| 1928 | | | gchar ip[4]; |
| 1929 | | | |
| 1930 | | | |
| 1931 | | | |
| 1932 | | | sub_item = proto_tree_add_item(tree, hf_dcom_objref, tvb, offset, 0, FALSE); |
| 1933 | | | sub_tree = proto_item_add_subtree(sub_item, ett_dcom_objref); |
| 1934 | | | |
| 1935 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1936 | | | hf_dcom_objref_signature, &u32Signature); |
| 1937 | | | |
| 1938 | | | u32SubStart = offset - 4; |
| 1939 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1940 | | | hf_dcom_objref_flags, &u32Flags); |
| 1941 | | | offset = dissect_dcom_UUID(tvb, offset, pinfo, sub_tree, drep, |
| 1942 | | | hf_dcom_iid, &iid); |
| 1943 | | | |
| 1944 | | | switch(u32Flags) { |
Event 1:
u32Flags evaluates to 2.
hide
|
|
| 1945 | | | case(0x1): |
| 1946 | | | offset = dissect_dcom_STDOBJREF(tvb, offset, pinfo, sub_tree, drep, hfindex, |
| 1947 | | | &oxid, &oid, &ipid); |
| 1948 | | | offset = dissect_dcom_DUALSTRINGARRAY(tvb, offset, pinfo, sub_tree, drep, |
| 1949 | | | hf_dcom_objref_resolver_address, ip); |
| 1950 | | | break; |
| 1951 | | | case(0x2): |
| 1952 | | | offset = dissect_dcom_STDOBJREF(tvb, offset, pinfo, sub_tree, drep, hfindex, |
| 1953 | [+] | | &oxid, &oid, &iid); |
 |
| 1954 | | | offset = dissect_dcom_UUID(tvb, offset, pinfo, sub_tree, drep, |
| 1955 | | | hf_dcom_clsid, &clsid); |
| 1956 | | | offset = dissect_dcom_DUALSTRINGARRAY(tvb, offset, pinfo, sub_tree, drep, |
| 1957 | | | hf_dcom_objref_resolver_address, ip); |
| 1958 | | | break; |
| 1959 | | | case(0x4): |
| 1960 | | | offset = dissect_dcom_UUID(tvb, offset, pinfo, sub_tree, drep, |
| 1961 | | | hf_dcom_clsid, &clsid); |
| 1962 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1963 | | | hf_dcom_objref_cbextension, &u32CBExtension); |
| 1964 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1965 | | | hf_dcom_objref_size, &u32Size); |
| 1966 | | | |
| 1967 | | | offset = dissect_dcom_nospec_data(tvb, offset, pinfo, sub_tree, drep, u32Size); |
| 1968 | | | break; |
| 1969 | | | } |
| 1970 | | | |
| 1971 | | | if(u32Flags == 0x1 || u32Flags == 0x2) { |
| 1972 | | | |
| 1973 | | | if(pinfo->net_src.type == AT_IPv4) { |
Event 3:
Taking true branch. pinfo->net_src.type == AT_IPv4 evaluates to true.
hide
|
|
| 1974 | | | dcom_if = dcom_interface_new(pinfo, |
| 1975 | | | (guint8 *) ip, |
| 1976 | [+] | | &iid, oxid, oid, &ipid); |
Event 4:
&ipid is passed to dcom_interface_new() as the sixth argument.
hide
Event 5:
dcom_interface_new() does not initialize ipid. - This may be because of a failure case or other special case for dcom_interface_new().
hide
|
|
 |
| |