(/home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/mate/packet-mate.c) |
| |
| 262 | | | static void mate_pdu_tree(mate_pdu *pdu, tvbuff_t *tvb, proto_tree* tree) { |
| 263 | | | proto_item *pdu_item; |
| 264 | | | proto_tree *pdu_tree; |
| 265 | | | |
| 266 | | | if ( ! pdu ) return; |
Event 1:
Skipping " if". pdu evaluates to true.
hide
|
|
| 267 | | | |
| 268 | | | if (pdu->gop && pdu->gop->gog) { |
| 269 | | | proto_item_append_text(mate_i," %s:%d->%s:%d->%s:%d", |
| 270 | | | pdu->cfg->name,pdu->id, |
| 271 | | | pdu->gop->cfg->name,pdu->gop->id, |
| 272 | | | pdu->gop->gog->cfg->name,pdu->gop->gog->id); |
| 273 | | | } else if (pdu->gop) { |
| 274 | | | proto_item_append_text(mate_i," %s:%d->%s:%d", |
| 275 | | | pdu->cfg->name,pdu->id, |
| 276 | | | pdu->gop->cfg->name,pdu->gop->id); |
| 277 | | | } else { |
| 278 | | | proto_item_append_text(mate_i," %s:%d",pdu->cfg->name,pdu->id); |
| 279 | | | } |
| 280 | | | |
| 281 | | | pdu_item = proto_tree_add_uint(tree,pdu->cfg->hfid,tvb,0,0,pdu->id); |
| 282 | | | pdu_tree = proto_item_add_subtree(pdu_item, pdu->cfg->ett); |
| 283 | | | proto_tree_add_float(pdu_tree,pdu->cfg->hfid_pdu_rel_time, tvb, 0, 0, pdu->rel_time); |
| 284 | | | |
| 285 | | | if (pdu->gop) { |
Event 4:
Taking true branch. pdu->gop evaluates to true.
hide
|
|
| 286 | | | proto_tree_add_float(pdu_tree,pdu->cfg->hfid_pdu_time_in_gop, tvb, 0, 0, pdu->time_in_gop); |
| 287 | | | mate_gop_tree(tree,tvb,pdu->gop); |
| 288 | | | |
| 289 | | | if (pdu->gop->gog) |
Null Test After Dereference
This code tests the nullness of pdu->gop->gog, which has already been dereferenced. - If pdu->gop->gog were null, there would have been a prior null pointer dereference at packet-mate.c:272, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 3. Show: All events | Only primary events |
|
| 290 | | | mate_gog_tree(tree,tvb,pdu->gop->gog,pdu->gop); |
| 291 | | | } |
| 292 | | | |
| 293 | | | if (pdu->avpl) { |
| 294 | | | pdu_attrs_tree(pdu_tree,tvb,pdu); |
| 295 | | | } |
| 296 | | | } |
| |