(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smb.c) |
| |
| 9081 | | | dissect_nt_transaction_response(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, proto_tree *smb_tree _U_) |
| 9082 | | | { |
| 9083 | | | guint8 wc, sc; |
| 9084 | | | guint32 pc=0, po=0, pd=0, dc=0, od=0, dd=0; |
| 9085 | | | guint32 td=0, tp=0; |
| 9086 | | | smb_info_t *si; |
| 9087 | | | smb_nt_transact_info_t *nti=NULL; |
| 9088 | | | static nt_trans_data ntd; |
| 9089 | | | guint16 bc; |
| 9090 | | | gint32 padcnt; |
| 9091 | | | fragment_data *r_fd = NULL; |
| 9092 | | | tvbuff_t *pd_tvb=NULL; |
| 9093 | | | gboolean save_fragmented; |
| 9094 | | | |
| 9095 | | | si = (smb_info_t *)pinfo->private_data; |
| 9096 | | | DISSECTOR_ASSERT(si);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
117 | #define DISSECTOR_ASSERT(expression) \ |
118 | ((void) ((expression) ? (void)0 : \ |
119 | __DISSECTOR_ASSERT (expression, __FILE__, __LINE__))) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
138 | #define __DISSECTOR_ASSERT(expression, file, lineno) \ |
139 | (REPORT_DISSECTOR_BUG( \ |
140 | ep_strdup_printf("%s:%u: failed assertion \"%s\"", \ |
141 | file, lineno, __DISSECTOR_ASSERT_STRINGIFY(expression)))) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
106 | #define REPORT_DISSECTOR_BUG(message) \ |
107 | ((getenv("WIRESHARK_ABORT_ON_DISSECTOR_BUG") != NULL) ? \ |
108 | abort() : \ |
109 | THROW_MESSAGE(DissectorError, message)) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/exceptions.h |
| |
226 | #define THROW_MESSAGE(x, y) \ |
227 | except_throw(XCEPT_GROUP_WIRESHARK, (x), (y)) |
| |
|
Event 1:
si evaluates to true.
hide
|
|
| 9097 | | | |
| 9098 | | | if (si->sip != NULL && si->sip-> == SMB_EI_NTI) |
| 9099 | | | nti = si->sip->; |
| 9100 | | | else |
| 9101 | | | nti = NULL; |
| 9102 | | | |
| 9103 | | | |
| 9104 | | | if(nti != NULL){ |
Event 3:
Taking false branch. nti != (void *)0 evaluates to false.
hide
|
|
| 9105 | | | proto_tree_add_uint(tree, hf_smb_nt_trans_subcmd, tvb, 0, 0, nti->subcmd); |
| 9106 | | | if(check_col(pinfo->cinfo, COL_INFO)){ |
| 9107 | | | col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", |
| 9108 | | | val_to_str(nti->subcmd, nt_cmd_vals, "<unknown (%u)>")); |
| 9109 | | | } |
| 9110 | | | } else { |
| 9111 | | | proto_tree_add_text(tree, tvb, offset, 0, |
| 9112 | | | "Function: <unknown function - could not find matching request>"); |
| 9113 | [+] | | if(check_col(pinfo->cinfo, COL_INFO)){ |
 |
| 9114 | | | col_append_str(pinfo->cinfo, COL_INFO, ", <unknown>"); |
| 9115 | | | } |
| 9116 | | | } |
| 9117 | | | |
| 9118 | | | WORD_COUNT;
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smb.c |
| |
784 | #define WORD_COUNT \ |
785 | /* Word Count */ \ |
786 | wc = tvb_get_guint8(tvb, offset); \ |
787 | proto_tree_add_uint(tree, hf_smb_word_count, \ |
788 | tvb, offset, 1, wc); \ |
789 | offset += 1; \ |
790 | if(wc==0) goto bytecount; |
| |
|
Event 6:
Skipping " if". wc == 0 evaluates to false.
hide
|
|
| 9119 | | | |
| 9120 | | | |
| 9121 | | | proto_tree_add_item(tree, hf_smb_reserved, tvb, offset, 3, TRUE); |
Event 7:
!0 evaluates to true.
hide
|
|
| 9122 | | | offset += 3; |
| 9123 | | | |
| 9124 | | | |
| 9125 | [+] | | tp = tvb_get_letohl(tvb, offset); |
 |
| 9126 | | | proto_tree_add_uint(tree, hf_smb_total_param_count, tvb, offset, 4, tp); |
| 9127 | | | offset += 4; |
| 9128 | | | |
| 9129 | | | |
| 9130 | | | td = tvb_get_letohl(tvb, offset); |
| 9131 | | | proto_tree_add_uint(tree, hf_smb_total_data_count, tvb, offset, 4, td); |
| 9132 | | | offset += 4; |
| 9133 | | | |
| 9134 | | | |
| 9135 | [+] | | pc = tvb_get_letohl(tvb, offset); |
 |
| 9136 | | | proto_tree_add_uint(tree, hf_smb_param_count32, tvb, offset, 4, pc); |
| 9137 | | | offset += 4; |
| 9138 | | | |
| 9139 | | | |
| 9140 | | | po = tvb_get_letohl(tvb, offset); |
| 9141 | | | proto_tree_add_uint(tree, hf_smb_param_offset32, tvb, offset, 4, po); |
| 9142 | | | offset += 4; |
| 9143 | | | |
| 9144 | | | |
| 9145 | | | pd = tvb_get_letohl(tvb, offset); |
| 9146 | | | proto_tree_add_uint(tree, hf_smb_param_disp32, tvb, offset, 4, pd); |
| 9147 | | | offset += 4; |
| 9148 | | | |
| 9149 | | | |
| 9150 | [+] | | dc = tvb_get_letohl(tvb, offset); |
 |
| 9151 | | | proto_tree_add_uint(tree, hf_smb_data_count32, tvb, offset, 4, dc); |
| 9152 | | | offset += 4; |
| 9153 | | | |
| 9154 | | | |
| 9155 | | | od = tvb_get_letohl(tvb, offset); |
| 9156 | | | proto_tree_add_uint(tree, hf_smb_data_offset32, tvb, offset, 4, od); |
| 9157 | | | offset += 4; |
| 9158 | | | |
| 9159 | | | |
| 9160 | | | dd = tvb_get_letohl(tvb, offset); |
| 9161 | | | proto_tree_add_uint(tree, hf_smb_data_disp32, tvb, offset, 4, dd); |
| 9162 | | | offset += 4; |
| 9163 | | | |
| 9164 | | | |
| 9165 | [+] | | sc = tvb_get_guint8(tvb, offset); |
 |
| 9166 | | | proto_tree_add_uint(tree, hf_smb_setup_count, tvb, offset, 1, sc); |
| 9167 | | | offset += 1; |
| 9168 | | | |
| 9169 | | | |
| 9170 | | | if(sc){ |
Event 12:
Skipping " if". sc evaluates to false.
hide
|
|
| 9171 | | | dissect_nt_trans_setup_response(tvb, pinfo, offset, tree, sc*2, &ntd); |
| 9172 | | | offset += sc*2; |
| 9173 | | | } |
| 9174 | | | |
| 9175 | [+] | | BYTE_COUNT;
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smb.c |
| |
792 | #define BYTE_COUNT \ |
793 | bytecount: \ |
794 | bc = tvb_get_letohs(tvb, offset); \ |
795 | proto_tree_add_uint(tree, hf_smb_byte_count, \ |
796 | tvb, offset, 2, bc); \ |
797 | offset += 2; \ |
798 | if(bc==0) goto endofcommand; |
| |
|
 |
| 9176 | | | |
| 9177 | | | |
| 9178 | | | |
| 9179 | | | |
| 9180 | | | |
| 9181 | | | save_fragmented = pinfo->fragmented; |
| 9182 | | | |
| 9183 | | | if( (td&&(td!=dc)) || (tp&&(tp!=pc)) ){ |
| 9184 | | | |
| 9185 | | | |
| 9186 | | | |
| 9187 | | | pinfo->fragmented = TRUE; |
Event 15:
!0 evaluates to true.
hide
|
|
| 9188 | | | if(smb_trans_reassembly){ |
Event 16:
Taking true branch. smb_trans_reassembly evaluates to true.
hide
|
|
| 9189 | | | |
| 9190 | | | if(pc && ((unsigned int)tvb_length_remaining(tvb, po)>=pc) ){ |
Event 17:
Skipping " if". pc evaluates to false.
hide
|
|
| 9191 | | | r_fd = smb_trans_defragment(tree, pinfo, tvb, |
| 9192 | | | po, pc, pd, td+tp); |
| 9193 | | | |
| 9194 | | | } |
| 9195 | [+] | | if((r_fd==NULL) && dc && ((unsigned int)tvb_length_remaining(tvb, od)>=dc) ){ |
Event 18:
Skipping " if". - r_fd == (void *)0 evaluates to true.
- dc evaluates to true.
hide
|
|
 |
| |