(/home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/profinet/packet-dcom-cba-acco.c) |
| |
| 2265 | | | dissect_ICBAAccoServerSRT_ConnectCR_resp(tvbuff_t *tvb, int offset, |
| 2266 | | | packet_info *pinfo, proto_tree *tree, guint8 *drep) |
| 2267 | | | { |
| 2268 | | | guint8 u8FirstConnect; |
| 2269 | | | guint8 u8ProvMac[6]; |
| 2270 | | | guint32 u32ProvCRID = 0; |
| 2271 | | | guint32 u32HResult; |
| 2272 | | | guint32 u32ArraySize; |
| 2273 | | | guint32 u32Idx = 1; |
| 2274 | | | guint32 u32Pointer; |
| 2275 | | | proto_item *sub_item; |
| 2276 | | | proto_tree *sub_tree; |
| 2277 | | | guint32 u32SubStart; |
| 2278 | | | proto_item *item; |
| 2279 | | | dcerpc_info *info = (dcerpc_info *)pinfo->private_data; |
| 2280 | | | server_frame_call_t *call = info->call_data->private_data; |
| 2281 | | | cba_frame_t *frame; |
| 2282 | | | |
| 2283 | | | |
| 2284 | | | offset = dissect_dcom_that(tvb, offset, pinfo, tree, drep); |
| 2285 | | | |
| 2286 | | | if(call == NULL) { |
Event 1:
Skipping " if". call == (void *)0 evaluates to false.
hide
|
|
| 2287 | | | expert_add_info_format(pinfo, NULL, PI_UNDECODED, PI_NOTE, |
| 2288 | | | "No request info, response data ignored"); |
| 2289 | | | } |
| 2290 | | | |
| 2291 | | | item = proto_tree_add_boolean (tree, hf_cba_acco_srt_call, tvb, offset, 0, FALSE); |
| 2292 | | | PROTO_ITEM_SET_GENERATED(item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
325 | #define PROTO_ITEM_SET_GENERATED(proto_item) \ |
326 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_GENERATED) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
Event 2:
item evaluates to false.
hide
|
|
| 2293 | | | pinfo->profinet_type = 3; |
| 2294 | | | |
| 2295 | | | offset = dissect_dcom_BOOLEAN(tvb, offset, pinfo, tree, drep, |
| 2296 | [+] | | hf_cba_acco_server_first_connect, &u8FirstConnect); |
Event 3:
dissect_ndr_uint8() does not initialize u8FirstConnect. - This may be because of a failure case or other special case for dissect_ndr_uint8().
hide
|
|
 |
| 2297 | | | |
| 2298 | | | |
| 2299 | | | tvb_memcpy(tvb, u8ProvMac, offset, 6); |
| 2300 | | | |
| 2301 | | | proto_tree_add_ether(tree, hf_cba_acco_serversrt_prov_mac, tvb, |
| 2302 | | | offset, 6, u8ProvMac); |
| 2303 | | | offset += 6; |
| 2304 | | | |
| 2305 | | | |
| 2306 | | | offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, drep, |
| 2307 | | | &u32Pointer); |
| 2308 | | | if (u32Pointer) { |
Event 5:
Skipping " if". u32Pointer evaluates to false.
hide
|
|
| 2309 | | | |
| 2310 | | | offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, drep, |
| 2311 | | | &u32ArraySize); |
| 2312 | | | |
| 2313 | | | while (u32ArraySize--) { |
| 2314 | | | |
| 2315 | | | sub_item = proto_tree_add_item(tree, hf_cba_connectoutcr, tvb, offset, 0, FALSE); |
| 2316 | | | sub_tree = proto_item_add_subtree(sub_item, ett_cba_connectoutcr); |
| 2317 | | | u32SubStart = offset; |
| 2318 | | | |
| 2319 2333 |  | | [ Lines 2319 to 2333 omitted. ] |
| 2334 | | | |
| 2335 | | | proto_item_append_text(sub_item, "[%u]: ProvCRID=0x%x, %s", |
| 2336 | | | u32Idx, u32ProvCRID, |
| 2337 | | | val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") ); |
| 2338 | | | proto_item_set_len(sub_item, offset - u32SubStart); |
| 2339 | | | |
| 2340 | | | u32Idx++; |
| 2341 | | | } |
| 2342 | | | } |
| 2343 | | | |
| 2344 | | | offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, drep, |
| 2345 | | | &u32HResult); |
| 2346 | | | |
| 2347 | | | |
| 2348 | | | while(call && u32Idx <= call->frame_count) { |
| 2349 | | | frame = call->frames[u32Idx-1]; |
| 2350 | | | frame->provcrid = 0; |
| 2351 | | | frame->conncrret = u32HResult; |
| 2352 | | | u32Idx++; |
| 2353 | | | } |
| 2354 | | | |
| 2355 | [+] | | if (check_col(pinfo->cinfo, COL_INFO)) { |
 |
| 2356 | | | col_append_fstr(pinfo->cinfo, COL_INFO, ": %s PCRID=0x%x -> %s", |
| 2357 | | | (u8FirstConnect) ? "FirstCR" : "NotFirstCR", |
Uninitialized Variable
u8FirstConnect was not initialized. The issue can occur if the highlighted code executes. See related event 3. Show: All events | Only primary events |
|
| 2358 | | | u32ProvCRID, |
| 2359 | | | val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") ); |
| |