(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-ipv6.c) |
| |
| 454 | | | dissect_ipv6_options(tvbuff_t *tvb, int offset, guint length, |
| 455 | | | const ip_tcp_opt *opttab, int nopts, int eol, |
| 456 | | | packet_info *pinfo, proto_tree *opt_tree) |
| 457 | | | { |
| 458 | | | guchar opt; |
| 459 | | | const ip_tcp_opt *optp; |
| 460 | | | opt_len_type len_type; |
| 461 | | | unsigned int optlen; |
| 462 | | | const char *name; |
| 463 | | | char name_str[7+1+1+2+2+1+1]; |
| 464 | | | void (*dissect)(const struct ip_tcp_opt *, tvbuff_t *, |
| 465 | | | int, guint, packet_info *, proto_tree *); |
| 466 | | | guint len; |
| 467 | | | |
| 468 | | | while (length > 0) { |
Event 1:
Performing all but the last loop iteration.
hide
Event 2:
Continuing from loop body. Entering loop body. length > 0 evaluates to true.
hide
|
|
| 469 | | | opt = tvb_get_guint8(tvb, offset); |
| 470 | | | for (optp = &opttab[0]; optp < &opttab[nopts]; optp++) { |
Event 3:
Leaving loop. optp < &opttab[nopts] evaluates to false.
hide
|
|
| 471 | | | if (optp->optcode == opt) |
| 472 | | | break; |
| 473 | | | } |
| 474 | | | if (optp == &opttab[nopts]) { |
Event 4:
Taking false branch. optp == &opttab[nopts] evaluates to false.
hide
|
|
| 475 | | | |
| 476 | | | |
| 477 | | | |
| 478 | | | |
| 479 | | | optp = NULL; |
| 480 | | | len_type = VARIABLE_LENGTH; |
| 481 | | | optlen = 0; |
| 482 | | | g_snprintf(name_str, sizeof name_str, "Unknown (0x%02x)", opt); |
| 483 | | | name = name_str; |
| 484 | | | dissect = NULL; |
| 485 | | | } else { |
| 486 | | | len_type = optp->len_type; |
| 487 | | | optlen = optp->optlen; |
| 488 | | | name = optp->name; |
| 489 | | | dissect = optp->dissect; |
| 490 | | | } |
| 491 | | | --length; |
| 492 | | | if (len_type != NO_LENGTH) { |
Event 6:
Taking true branch. len_type != NO_LENGTH evaluates to true.
hide
|
|
| 493 | | | |
| 494 | | | if (length == 0) { |
Event 7:
Skipping " if". length == 0 evaluates to false.
hide
|
|
| 495 | | | |
| 496 | | | |
| 497 | | | proto_tree_add_text(opt_tree, tvb, offset, 1, |
| 498 | | | "%s (length byte past end of options)", name); |
| 499 | | | return; |
| 500 | | | } |
| 501 | | | len = tvb_get_guint8(tvb, offset + 1); |
| 502 | | | --length; |
| 503 | | | if (len > length) { |
Event 8:
Taking false branch. len > length evaluates to false.
hide
|
|
| 504 | | | |
| 505 | | | proto_tree_add_text(opt_tree, tvb, offset, length, |
| 506 | | | "%s (option length = %u byte%s says option goes past end of options)", |
| 507 | | | name, len, plurality(len, "", "s")); |
| 508 | | | return; |
| 509 | | | } else if (len_type == FIXED_LENGTH && len != optlen) { |
Event 9:
Taking false branch. len_type == FIXED_LENGTH evaluates to false.
hide
|
|
| 510 | | | |
| 511 | | | |
| 512 | | | proto_tree_add_text(opt_tree, tvb, offset, 2 + len, |
| 513 | | | "%s (with option length = %u byte%s; should be %u)", name, |
| 514 | | | len, plurality(len, "", "s"), optlen); |
| 515 | | | return; |
| 516 | | | } else if (len_type == VARIABLE_LENGTH && len < optlen) { |
Event 10:
Taking false branch. len_type == VARIABLE_LENGTH evaluates to false.
hide
|
|
| 517 | | | |
| 518 | | | |
| 519 | | | proto_tree_add_text(opt_tree, tvb, offset, 2 + len, |
| 520 | | | "%s (with option length = %u byte%s; should be >= %u)", name, |
| 521 | | | len, plurality(len, "", "s"), optlen); |
| 522 | | | return; |
| 523 | | | } else { |
| 524 | | | if (optp == NULL) { |
Null Test After Dereference
This code tests the nullness of optp, which has already been dereferenced. - If optp were null, there would have been a prior null pointer dereference at packet-ipv6.c:489, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 5. Show: All events | Only primary events |
|
| 525 | | | proto_tree_add_text(opt_tree, tvb, offset, 2 + len, "%s (%u byte%s)", |
| 526 | | | name, len, plurality(len, "", "s")); |
| 527 | | | } else { |
| 528 | | | if (dissect != NULL) { |
| 529 | | | |
| 530 | | | (*dissect)(optp, tvb, offset, 2 + len, pinfo, opt_tree); |
| 531 | | | } else { |
| 532 | | | |
| 533 | | | proto_tree_add_text(opt_tree, tvb, offset, 2 + len, "%s", name); |
| 534 | | | } |
| 535 | | | } |
| 536 | | | offset += 2 + len; |
| 537 | | | } |
| 538 | | | length -= len; |
| 539 | | | } else { |
| 540 | | | proto_tree_add_text(opt_tree, tvb, offset, 1, "%s", name); |
| 541 | | | offset += 1; |
| 542 | | | } |
| 543 | | | if (opt == eol) |
| 544 | | | break; |
| 545 | | | } |
| 546 | | | } |
| |