(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-ntlmssp.c) |
| |
| 1020 | | | dissect_ntlmssp_auth (tvbuff_t *tvb, packet_info *pinfo, int offset, |
| 1021 | | | proto_tree *ntlmssp_tree, *ntlmssph) |
| 1022 | | | { |
| 1023 | | | int item_start, item_end; |
| 1024 | | | int data_start, data_end = 0; |
| 1025 | | | guint32 negotiate_flags; |
| 1026 | | | gboolean unicode_strings = FALSE; |
| 1027 | | | ntlmssp_info *conv_ntlmssp_info; |
| 1028 | | | conversation_t *conversation; |
| 1029 | | | |
| 1030 | | | |
| 1031 | | | |
| 1032 | | | |
| 1033 | | | |
| 1034 | | | |
| 1035 | | | |
| 1036 | | | conv_ntlmssp_info = p_get_proto_data(pinfo->fd, proto_ntlmssp); |
| 1037 | | | if (conv_ntlmssp_info == NULL) { |
Event 1:
Skipping " if". conv_ntlmssp_info == (void *)0 evaluates to false.
hide
|
|
| 1038 | | | |
| 1039 | | | |
| 1040 | | | |
| 1041 | | | |
| 1042 | | | |
| 1043 | | | conversation = find_conversation(pinfo->fd->num, &pinfo->src, &pinfo->dst, |
| 1044 | | | pinfo->ptype, pinfo->srcport, |
| 1045 | | | pinfo->destport, 0); |
| 1046 | | | if (conversation != NULL) { |
| 1047 | | | conv_ntlmssp_info = conversation_get_proto_data(conversation, proto_ntlmssp); |
| 1048 | | | if (conv_ntlmssp_info != NULL) { |
| 1049 | | | |
| 1050 | | | |
| 1051 | | | |
| 1052 | | | p_add_proto_data(pinfo->fd, proto_ntlmssp, conv_ntlmssp_info); |
| 1053 | | | } |
| 1054 | | | } |
| 1055 | | | } |
| 1056 | | | if (conv_ntlmssp_info != NULL) { |
Event 2:
Taking true branch. conv_ntlmssp_info != (void *)0 evaluates to true.
hide
|
|
| 1057 | | | if (conv_ntlmssp_info->flags & NTLMSSP_NEGOTIATE_UNICODE) |
Event 3:
Skipping " if". conv_ntlmssp_info->flags & 1 evaluates to false.
hide
|
|
| 1058 | | | unicode_strings = TRUE; |
| 1059 | | | } |
| 1060 | | | |
| 1061 | | | |
| 1062 | | | |
| 1063 | | | |
| 1064 | | | |
| 1065 | | | |
| 1066 | | | |
| 1067 | | | |
| 1068 | | | |
| 1069 | | | |
| 1070 | | | |
| 1071 | | | |
| 1072 | | | |
| 1073 | | | |
| 1074 | | | |
| 1075 | | | |
| 1076 | | | |
| 1077 | | | |
| 1078 | | | data_start = tvb_get_letohl(tvb, offset+4); |
| 1079 | | | offset = dissect_ntlmssp_blob(tvb, offset, ntlmssp_tree, |
| 1080 | | | hf_ntlmssp_auth_lmresponse, |
| 1081 | | | &item_end, |
| 1082 | | | conv_ntlmssp_info == NULL ? NULL : |
Event 5:
conv_ntlmssp_info == (void *)0 evaluates to false.
hide
|
|
| 1083 | | | &conv_ntlmssp_info->lm_response); |
| 1084 | | | data_end = MAX(data_end, item_end);
x /usr/include/glib-2.0/glib/gmacros.h |
| |
198 | #define MAX(a, b) (((a) > (b)) ? (a) : (b)) |
| |
|
Event 6:
data_end > item_end evaluates to true.
hide
|
|
| 1085 | | | |
| 1086 | | | |
| 1087 | | | item_start = tvb_get_letohl(tvb, offset+4); |
| 1088 | | | offset = dissect_ntlmssp_blob(tvb, offset, ntlmssp_tree, |
| 1089 | | | hf_ntlmssp_auth_ntresponse, |
| 1090 | | | &item_end, |
| 1091 | | | conv_ntlmssp_info == NULL ? NULL : |
Null Test After Dereference
This code tests the nullness of conv_ntlmssp_info, which has already been dereferenced. - If conv_ntlmssp_info were null, there would have been a prior null pointer dereference at packet-ntlmssp.c:1057, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 4. Show: All events | Only primary events |
|
| 1092 | | | &conv_ntlmssp_info->ntlm_response); |
| 1093 | | | data_start = MIN(data_start, item_start);
x /usr/include/glib-2.0/glib/gmacros.h |
| |
201 | #define MIN(a, b) (((a) < (b)) ? (a) : (b)) |
| |
|
| 1094 | | | data_end = MAX(data_end, item_end);
x /usr/include/glib-2.0/glib/gmacros.h |
| |
198 | #define MAX(a, b) (((a) > (b)) ? (a) : (b)) |
| |
|
| 1095 | | | |
| 1096 | | | |
| 1097 | | | item_start = tvb_get_letohl(tvb, offset+4); |
| 1098 | | | offset = dissect_ntlmssp_string(tvb, offset, ntlmssp_tree, |
| 1099 | | | unicode_strings, |
| 1100 | | | hf_ntlmssp_auth_domain, |
| 1101 | | | &item_start, &item_end, &(ntlmssph->domain_name)); |
| 1102 | | | data_start = MIN(data_start, item_start);
x /usr/include/glib-2.0/glib/gmacros.h |
| |
201 | #define MIN(a, b) (((a) < (b)) ? (a) : (b)) |
| |
|
| 1103 | | | data_end = MAX(data_end, item_end);
x /usr/include/glib-2.0/glib/gmacros.h |
| |
198 | #define MAX(a, b) (((a) > (b)) ? (a) : (b)) |
| |
|
| 1104 | | | |
| 1105 | | | |
| 1106 | | | item_start = tvb_get_letohl(tvb, offset+4); |
| 1107 | | | offset = dissect_ntlmssp_string(tvb, offset, ntlmssp_tree, |
| 1108 | | | unicode_strings, |
| 1109 | | | hf_ntlmssp_auth_username, |
| 1110 | | | &item_start, &item_end, &(ntlmssph->acct_name)); |
| 1111 | | | data_start = MIN(data_start, item_start);
x /usr/include/glib-2.0/glib/gmacros.h |
| |
201 | #define MIN(a, b) (((a) < (b)) ? (a) : (b)) |
| |
|
| 1112 | | | data_end = MAX(data_end, item_end);
x /usr/include/glib-2.0/glib/gmacros.h |
| |
198 | #define MAX(a, b) (((a) > (b)) ? (a) : (b)) |
| |
|
| 1113 | | | |
| 1114 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
| 1115 | | | col_append_fstr(pinfo->cinfo, COL_INFO, ", User: %s\\%s", |
| 1116 | | | ntlmssph->domain_name, ntlmssph->acct_name); |
| 1117 | | | |
| 1118 | | | |
| 1119 | | | item_start = tvb_get_letohl(tvb, offset+4); |
| 1120 | | | offset = dissect_ntlmssp_string(tvb, offset, ntlmssp_tree, |
| 1121 | | | unicode_strings, |
| 1122 | | | hf_ntlmssp_auth_hostname, |
| 1123 | | | &item_start, &item_end, &(ntlmssph->host_name)); |
| 1124 | | | data_start = MIN(data_start, item_start);
x /usr/include/glib-2.0/glib/gmacros.h |
| |
201 | #define MIN(a, b) (((a) < (b)) ? (a) : (b)) |
| |
|
| 1125 | | | data_end = MAX(data_end, item_end);
x /usr/include/glib-2.0/glib/gmacros.h |
| |
198 | #define MAX(a, b) (((a) > (b)) ? (a) : (b)) |
| |
|
| 1126 | | | |
| 1127 | | | if (offset < data_start) { |
| 1128 | | | |
| 1129 | | | offset = dissect_ntlmssp_blob(tvb, offset, ntlmssp_tree, |
| 1130 | | | hf_ntlmssp_auth_sesskey, |
| 1131 | | | &item_end, NULL); |
| 1132 | | | data_end = MAX(data_end, item_end);
x /usr/include/glib-2.0/glib/gmacros.h |
| |
198 | #define MAX(a, b) (((a) > (b)) ? (a) : (b)) |
| |
|
| 1133 | | | } |
| 1134 | | | |
| 1135 | | | if (offset < data_start) { |
| 1136 | | | |
| 1137 | | | negotiate_flags = tvb_get_letohl (tvb, offset); |
| 1138 | | | offset = dissect_ntlmssp_negotiate_flags (tvb, offset, ntlmssp_tree, |
| 1139 | | | negotiate_flags); |
| 1140 | | | } |
| 1141 | | | |
| 1142 | | | return MAX(offset, data_end);
x /usr/include/glib-2.0/glib/gmacros.h |
| |
198 | #define MAX(a, b) (((a) > (b)) ? (a) : (b)) |
| |
|
| 1143 | | | } |
| |