(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-bacapp.c) |
| |
| 1851 | | | (tvbuff_t *tvb, proto_tree *tree, guint offset, |
| 1852 | | | guint8 *tag_no, guint8* tag_info, guint32 *lvt) |
| 1853 | | | { |
| 1854 | | | guint8 tag; |
| 1855 | | | guint8 value; |
| 1856 | | | guint tag_len = 1; |
| 1857 | | | guint lvt_len = 1; |
| 1858 | | | guint lvt_offset; |
| 1859 | | | proto_item *ti; |
| 1860 | | | proto_tree *subtree; |
| 1861 | | | |
| 1862 | | | lvt_offset = offset; |
| 1863 | | | tag = tvb_get_guint8(tvb, offset); |
| 1864 | | | *tag_info = 0; |
| 1865 | | | *lvt = tag & 0x07; |
| 1866 | | | |
| 1867 | | | |
| 1868 | | | |
| 1869 | | | if (tag_is_context_specific(tag)) *tag_info = tag & 0x0F; |
| 1870 | | | *tag_no = tag >> 4; |
| 1871 | | | if (tag_is_extended_tag_number(tag)) { |
| 1872 | | | *tag_no = tvb_get_guint8(tvb, offset + tag_len++); |
| 1873 | | | } |
| 1874 | | | if (tag_is_extended_value(tag)) { |
| 1875 | | | lvt_offset += tag_len; |
| 1876 | | | value = tvb_get_guint8(tvb, lvt_offset); |
| 1877 | | | tag_len++; |
| 1878 | | | if (value == 254) { |
| 1879 | | | *lvt = tvb_get_ntohs(tvb, lvt_offset+1); |
| 1880 | | | tag_len += 2; |
| 1881 | | | lvt_len += 2; |
| 1882 | | | } else if (value == 255) { |
| 1883 | | | *lvt = tvb_get_ntohl(tvb, lvt_offset+1); |
| 1884 | | | tag_len += 4; |
| 1885 | | | lvt_len += 4; |
| 1886 | | | } else |
| 1887 | | | *lvt = value; |
| 1888 | | | } |
| 1889 | | | if (tree) |
| 1890 | | | { |
| 1891 | | | if (tag_is_closing(tag) || tag_is_opening(tag)) |
| 1892 | | | ti = proto_tree_add_text(tree, tvb, offset, tag_len, |
| 1893 | | | "%s: %u", val_to_str( |
| 1894 | | | tag & 0x07, BACnetTagNames, "Unknown (%d)"), |
| 1895 | | | *tag_no); |
| 1896 | | | else if (tag_is_context_specific(tag)) { |
| 1897 | | | ti = proto_tree_add_text(tree, tvb, offset, tag_len, |
| 1898 | | | "Context Tag: %u, Length/Value/Type: %u", |
| 1899 | | | *tag_no, *lvt); |
| 1900 | | | } else |
| 1901 | | | ti = proto_tree_add_text(tree, tvb, offset, tag_len, |
| 1902 | | | "Application Tag: %s, Length/Value/Type: %u", |
| 1903 | | | val_to_str(*tag_no, |
| 1904 | | | BACnetApplicationTagNumber, |
| 1905 | | | ASHRAE_Reserved_Fmt), |
Format String
val_to_str() is being called with a format string that is not constant. The format string (third argument) may not match the other arguments to val_to_str(); this could lead to security or stability problems. val_to_str() is usually called with strings that look like format strings in this project. |
|
| 1906 | | | *lvt); |
| 1907 | | | subtree = proto_item_add_subtree(ti, ett_bacapp_tag); |
| 1908 | | | |
| 1909 | | | proto_tree_add_item(subtree, hf_BACnetTagClass, tvb, offset, 1, FALSE); |
| 1910 | | | if (tag_is_extended_tag_number(tag)) { |
| 1911 | | | proto_tree_add_uint_format(subtree, |
| 1912 | | | hf_BACnetContextTagNumber, |
| 1913 | | | tvb, offset, 1, tag, |
| 1914 | | | "Extended Tag Number"); |
| 1915 | | | proto_tree_add_item(subtree, |
| 1916 | | | hf_BACnetExtendedTagNumber, |
| 1917 | | | tvb, offset + 1, 1, FALSE); |
| 1918 | | | } else { |
| 1919 | | | if (tag_is_context_specific(tag)) |
| 1920 | | | proto_tree_add_item(subtree, |
| 1921 | | | hf_BACnetContextTagNumber, |
| 1922 | | | tvb, offset, 1, FALSE); |
| 1923 | | | else |
| 1924 | | | proto_tree_add_item(subtree, |
| 1925 | | | hf_BACnetApplicationTagNumber, |
| 1926 | | | tvb, offset, 1, FALSE); |
| 1927 | | | } |
| 1928 | | | if (tag_is_closing(tag) || tag_is_opening(tag)) |
| 1929 | | | proto_tree_add_item(subtree, |
| 1930 | | | hf_BACnetNamedTag, |
| 1931 | | | tvb, offset, 1, FALSE); |
| 1932 | | | else if (tag_is_extended_value(tag)) { |
| 1933 | | | proto_tree_add_item(subtree, |
| 1934 | | | hf_BACnetNamedTag, |
| 1935 | | | tvb, offset, 1, FALSE); |
| 1936 | | | proto_tree_add_uint(subtree, hf_bacapp_tag_lvt, |
| 1937 | | | tvb, lvt_offset, lvt_len, *lvt); |
| 1938 | | | } else |
| 1939 | | | proto_tree_add_uint(subtree, hf_bacapp_tag_lvt, |
| 1940 | | | tvb, lvt_offset, lvt_len, *lvt); |
| 1941 | | | } |
| 1942 | | | |
| 1943 | | | return tag_len; |
| 1944 | | | } |
| |