(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dcom.c) |
| |
| 1750 | | | dissect_dcom_DUALSTRINGARRAY(tvbuff_t *tvb, gint offset, packet_info *pinfo, |
| 1751 | | | proto_tree *tree, guint8 *drep, int hfindex, gchar *ip) |
| 1752 | | | { |
| 1753 | | | guint16 u16NumEntries; |
| 1754 | | | guint16 u16SecurityOffset; |
| 1755 | | | gchar szStr[1000]; |
| 1756 | | | guint32 u32MaxStr = sizeof(szStr); |
| 1757 | | | guint32 u32Start; |
| 1758 | | | guint16 u16TowerId; |
| 1759 | | | guint16 u16SecurityAuthnSvc; |
| 1760 | | | guint16 u16SecurityAuthzSvc; |
| 1761 | | | proto_item *sub_item; |
| 1762 | | | proto_tree *sub_tree; |
| 1763 | | | guint32 u32SubStart; |
| 1764 | | | guint32 u32StringBindings = 0; |
| 1765 | | | guint32 u32SecurityBindings = 0; |
| 1766 | | | proto_item *subsub_item; |
| 1767 | | | proto_tree *subsub_tree; |
| 1768 | | | guint32 u32SubSubStart; |
| 1769 | | | gboolean isPrintable; |
| 1770 | | | guint32 first_ip = 0; |
| 1771 | | | guint32 curr_ip = 0; |
| 1772 | | | struct in_addr ipaddr; |
| 1773 | | | proto_item *pi; |
| 1774 | | | |
| 1775 | | | |
| 1776 | | | |
| 1777 | | | sub_item = proto_tree_add_item(tree, hfindex, tvb, offset, 0, FALSE); |
| 1778 | | | sub_tree = proto_item_add_subtree(sub_item, ett_dcom_dualstringarray); |
| 1779 | | | |
| 1780 | | | offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, drep, |
| 1781 | | | hf_dcom_dualstringarray_num_entries, &u16NumEntries); |
| 1782 | | | |
| 1783 | | | u32SubStart = offset - 2; |
| 1784 | | | offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, drep, |
| 1785 | | | hf_dcom_dualstringarray_security_offset, &u16SecurityOffset); |
| 1786 | | | |
| 1787 | | | |
| 1788 | [+] | | while ( tvb_get_ntohs(tvb, offset) ) { |
 |
| 1789 | | | u32StringBindings++; |
| 1790 | | | |
| 1791 | | | subsub_item = proto_tree_add_item(sub_tree, hf_dcom_dualstringarray_string, tvb, offset, 0, FALSE); |
| 1792 | | | subsub_tree = proto_item_add_subtree(subsub_item, ett_dcom_dualstringarray_binding); |
| 1793 | | | u32SubSubStart = offset; |
| 1794 | | | |
| 1795 | | | offset = dissect_dcom_WORD(tvb, offset, pinfo, subsub_tree, drep, |
| 1796 | [+] | | hf_dcom_dualstringarray_string_tower_id, &u16TowerId); |
Event 2:
dissect_ndr_uint16() does not initialize u16TowerId. - This may be because of a failure case or other special case for dissect_ndr_uint16().
hide
|
|
 |
| 1797 | | | u32Start = offset; |
| 1798 | | | |
| 1799 | | | offset = dcom_tvb_get_nwstringz0(tvb, offset, u32MaxStr, szStr, u32MaxStr, &isPrintable); |
| 1800 | | | pi = proto_tree_add_string(subsub_tree, hf_dcom_dualstringarray_string_network_addr, |
| 1801 | | | tvb, u32Start, offset - u32Start, szStr); |
| 1802 | | | |
| 1803 | | | |
| 1804 | | | |
| 1805 | | | if (inet_aton(szStr, &ipaddr)) { |
Event 4:
Skipping " if". inet_aton(szStr, &ipaddr) evaluates to false.
hide
|
|
| 1806 | | | if(get_host_ipaddr(szStr, &curr_ip)) { |
| 1807 | | | curr_ip = g_ntohl(curr_ip);
x /usr/include/glib-2.0/glib/gtypes.h |
| |
347 | #define g_ntohl(val) (GUINT32_FROM_BE (val)) |
| |
x /usr/include/glib-2.0/glib/gtypes.h |
| |
322 | #define GUINT32_FROM_BE(val) (GUINT32_TO_BE (val)) |
| |
x /usr/lib/i386-linux-gnu/glib-2.0/include/glibconfig.h |
| |
196 | #define GUINT32_TO_BE(val) (GUINT32_SWAP_LE_BE (val)) |
| |
x /usr/include/glib-2.0/glib/gtypes.h |
| |
229 | # define GUINT32_SWAP_LE_BE(val) (GUINT32_SWAP_LE_BE_IA32 (val)) |
| |
x /usr/include/glib-2.0/glib/gtypes.h |
| |
203 | # define GUINT32_SWAP_LE_BE_IA32(val) \ |
204 | (__extension__ \ |
205 | ({ register guint32 __v, __x = ((guint32) (val)); \ |
206 | if (__builtin_constant_p (__x)) \ |
207 | __v = GUINT32_SWAP_LE_BE_CONSTANT (__x); \ |
208 | else \ |
209 | __asm__ ("bswap %0" \ |
210 | : "=r" (__v) \ |
211 | : "0" (__x)); \ |
212 | __v; })) |
| |
x /usr/include/glib-2.0/glib/gtypes.h |
| |
147 | #define GUINT32_SWAP_LE_BE_CONSTANT(val) ((guint32) ( \ |
148 | (((guint32) (val) & (guint32) 0x000000ffU) << 24) | \ |
149 | (((guint32) (val) & (guint32) 0x0000ff00U) << 8) | \ |
150 | (((guint32) (val) & (guint32) 0x00ff0000U) >> 8) | \ |
151 | (((guint32) (val) & (guint32) 0xff000000U) >> 24))) |
| |
|
| 1808 | | | |
| 1809 | | | |
| 1810 | | | |
| 1811 | | | |
| 1812 | | | if(first_ip == 0) { |
| 1813 | | | if(ip != NULL) { |
| 1814 | | | memcpy(ip, &curr_ip, sizeof(curr_ip)); |
| 1815 | | | } |
| 1816 | | | first_ip = curr_ip; |
| 1817 | | | } else { |
| 1818 | | | if(first_ip != curr_ip) { |
| 1819 | | | expert_add_info_format(pinfo, pi, PI_UNDECODED, PI_NOTE, |
| 1820 | | | "DUALSTRINGARRAY: multiple IP's %s %s", |
| 1821 | | | ip_to_str( (guint8 *) &first_ip), ip_to_str( (guint8 *) &curr_ip)); |
| 1822 | | | } |
| 1823 | | | } |
| 1824 | | | } |
| 1825 | | | } |
| 1826 | | | |
| 1827 | | | proto_item_append_text(subsub_item, "[%u]: TowerId=%s, NetworkAddr=\"%s\"", |
| 1828 | | | u32StringBindings, |
| 1829 | | | val_to_str(u16TowerId, dcom_protseq_vals, "Unknown (0x%04x"), |
Uninitialized Variable
u16TowerId was not initialized. The issue can occur if the highlighted code executes. See related event 2. Show: All events | Only primary events |
|
| 1830 | | | szStr); |
| |