(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-tipc.c) |
| |
| 2031 | | | dissect_tipc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) |
| 2032 | | | { |
| 2033 | | | proto_item *ti, *tipc_data_item, *item; |
| 2034 | | | proto_tree *tipc_tree, *tipc_data_tree; |
| 2035 | | | int offset = 0; |
| 2036 | | | guint32 dword; |
| 2037 | | | guint8 version; |
| 2038 | | | guint32 msg_size; |
| 2039 | | | guint8 hdr_size; |
| 2040 | | | guint8 user; |
| 2041 | | | gchar *addr_str_ptr; |
| 2042 | | | const guchar *src_addr, *dst_addr; |
| 2043 | | | tvbuff_t *data_tvb, *tipc_tvb; |
| 2044 | | | gboolean datatype_hdr = FALSE; |
| 2045 | | | guint8 msg_type = 0; |
| 2046 | | | |
| 2047 | | | |
| 2048 | [+] | | if (check_col(pinfo->cinfo, COL_PROTOCOL)) |
 |
| 2049 | | | col_set_str(pinfo->cinfo, COL_PROTOCOL, "TIPC"); |
| 2050 | | | |
| 2051 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
Event 4:
Taking true branch. check_col(...) evaluates to true.
hide
|
|
| 2052 | | | col_clear(pinfo->cinfo, COL_INFO); |
| 2053 | | | |
| 2054 | | | top_tree = tree; |
| 2055 | | | dword = tvb_get_ntohl(tvb, offset); |
| 2056 | | | version = (dword >>29) & 0xf; |
| 2057 | | | hdr_size = (dword >>21) & 0xf; |
| 2058 | | | user = (dword>>25) & 0xf; |
| 2059 | | | msg_size = dword & 0x1ffff; |
| 2060 | | | |
| 2061 | | | if ((guint32)tvb_length_remaining(tvb, offset) < msg_size) { |
Event 5:
Taking true branch. (guint32)tvb_length_remaining(...) < msg_size evaluates to true.
hide
|
|
| 2062 | | | tipc_tvb = tvb; |
| 2063 | | | } else { |
| 2064 | | | tipc_tvb = tvb_new_subset(tvb, offset, msg_size, msg_size); |
| 2065 | | | } |
| 2066 | | | |
| 2067 | | | if (user == TIPCv2_LINK_PROTOCOL) version = TIPCv2; |
Event 6:
Skipping " if". user == 7 evaluates to false.
hide
|
|
| 2068 | | | |
| 2069 | | | switch (version) { |
Event 7:
version evaluates to 0.
hide
|
|
| 2070 | | | case 0: |
| 2071 | | | case TIPCv1: |
| 2072 | | | msg_type = tvb_get_guint8(tipc_tvb, offset + 20)>>4; |
| 2073 | | | if (check_col(pinfo->cinfo, COL_INFO)) { |
Event 8:
Taking true branch. check_col(...) evaluates to true.
hide
|
|
| 2074 | | | col_append_fstr(pinfo->cinfo, COL_INFO, " %s(%u) ", val_to_str(user, tipc_user_values, "unknown"), user); |
| 2075 | | | } |
| 2076 | | | |
| 2077 | [+] | | datatype_hdr = tipc_v1_set_col_msgtype(pinfo, user, msg_type); |
 |
| 2078 | | | if (datatype_hdr) { |
Event 10:
Taking false branch. datatype_hdr evaluates to false.
hide
|
|
| 2079 | | | |
| 2080 | | | if (hdr_size > 5 && user <4) { |
| 2081 | | | |
| 2082 | | | src_addr = tvb_get_ptr(tipc_tvb, offset + 24, 4); |
| 2083 | | | SET_ADDRESS(&pinfo->src, AT_TIPC, 4, src_addr);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/address.h |
| |
66 | #define SET_ADDRESS(addr, addr_type, addr_len, addr_data) { \ |
67 | (addr)->type = (addr_type); \ |
68 | (addr)->len = (addr_len); \ |
69 | (addr)->data = (addr_data); \ |
70 | } |
| |
|
| 2084 | | | |
| 2085 | | | |
| 2086 | | | dst_addr = tvb_get_ptr(tipc_tvb, offset + 28, 4); |
| 2087 | | | SET_ADDRESS(&pinfo->dst, AT_TIPC, 4, dst_addr);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/address.h |
| |
66 | #define SET_ADDRESS(addr, addr_type, addr_len, addr_data) { \ |
67 | (addr)->type = (addr_type); \ |
68 | (addr)->len = (addr_len); \ |
69 | (addr)->data = (addr_data); \ |
70 | } |
| |
|
| 2088 | | | } else { |
| 2089 | | | |
| 2090 | | | |
| 2091 | | | src_addr = tvb_get_ptr(tipc_tvb, offset + 8, 4); |
| 2092 | | | SET_ADDRESS(&pinfo->src, AT_TIPC, 4, src_addr);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/address.h |
| |
66 | #define SET_ADDRESS(addr, addr_type, addr_len, addr_data) { \ |
67 | (addr)->type = (addr_type); \ |
68 | (addr)->len = (addr_len); \ |
69 | (addr)->data = (addr_data); \ |
70 | } |
| |
|
| 2093 | | | } |
| 2094 | | | } else { |
| 2095 | | | |
| 2096 | | | src_addr = tvb_get_ptr(tipc_tvb, offset + 8, 4); |
| 2097 | | | SET_ADDRESS(&pinfo->src, AT_TIPC, 4, src_addr);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/address.h |
| |
66 | #define SET_ADDRESS(addr, addr_type, addr_len, addr_data) { \ |
67 | (addr)->type = (addr_type); \ |
68 | (addr)->len = (addr_len); \ |
69 | (addr)->data = (addr_data); \ |
70 | } |
| |
|
| 2098 | | | } |
| 2099 | | | break; |
| 2100 | | | case TIPCv2: |
| 2101 | | | msg_type = tvb_get_guint8(tipc_tvb, offset + 4)>>5; |
| 2102 | | | if (check_col(pinfo->cinfo, COL_INFO)) { |
| 2103 | | | col_append_fstr(pinfo->cinfo, COL_INFO, "%-12s", val_to_str(user, tipcv2_user_short_str_vals, "unknown")); |
| 2104 | | | } |
| 2105 | | | |
| 2106 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
| 2107 | | | tipc_v2_set_info_col(tvb, pinfo, user, msg_type, hdr_size); |
| 2108 | | | |
| 2109 | | | |
| 2110 2150 |  | | [ Lines 2110 to 2150 omitted. ] |
| 2151 | | | |
| 2152 | | | src_addr = tvb_get_ptr(tipc_tvb, offset + 12, 4); |
| 2153 | | | SET_ADDRESS(&pinfo->src, AT_TIPC, 4, src_addr);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/address.h |
| |
66 | #define SET_ADDRESS(addr, addr_type, addr_len, addr_data) { \ |
67 | (addr)->type = (addr_type); \ |
68 | (addr)->len = (addr_len); \ |
69 | (addr)->data = (addr_data); \ |
70 | } |
| |
|
| 2154 | | | } |
| 2155 | | | } |
| 2156 | | | break; |
| 2157 | | | default: |
| 2158 | | | break; |
| 2159 | | | } |
| 2160 | | | |
| 2161 | | | ti = proto_tree_add_item(tree, proto_tipc, tipc_tvb, offset, -1, FALSE); |
| 2162 | | | tipc_tree = proto_item_add_subtree(ti, ett_tipc); |
| 2163 | | | if (version == TIPCv2) { |
Event 11:
Skipping " if". version == 2 evaluates to false.
hide
|
|
| 2164 | | | dissect_tipc_v2(tipc_tvb, tipc_tree, pinfo, offset, user, msg_size, hdr_size, datatype_hdr); |
| 2165 | | | return; |
| 2166 | | | } |
| 2167 | | | |
| 2168 | | | |
| 2169 | | | |
| 2170 | | | proto_tree_add_item(tipc_tree, hf_tipc_ver, tipc_tvb, offset, 4, FALSE); |
| 2171 | | | proto_tree_add_item(tipc_tree, hf_tipc_usr, tipc_tvb, offset, 4, FALSE); |
| 2172 | | | item = proto_tree_add_item(tipc_tree, hf_tipc_hdr_size, tipc_tvb, offset, 4, FALSE); |
| 2173 | | | proto_item_append_text(item, " = %u bytes", (hdr_size * 4)); |
| 2174 | | | proto_tree_add_item(tipc_tree, hf_tipc_nonsequenced, tipc_tvb, offset, 4, FALSE); |
| 2175 | | | proto_tree_add_item(tipc_tree, hf_tipc_unused, tipc_tvb, offset, 4, FALSE); |
| 2176 | | | if (datatype_hdr) { |
Event 12:
Skipping " if". datatype_hdr evaluates to false.
hide
|
|
| 2177 | | | proto_tree_add_item(tipc_tree, hf_tipc_destdrop, tipc_tvb, offset, 4, FALSE); |
| 2178 | | | proto_tree_add_item(tipc_tree, hf_tipcv2_srcdrop, tipc_tvb, offset, 4, FALSE); |
| 2179 | | | } |
| 2180 | | | |
| 2181 | | | proto_tree_add_item(tipc_tree, hf_tipc_msg_size, tipc_tvb, offset, 4, FALSE); |
| 2182 | | | offset = offset + 4; |
| 2183 | | | |
| 2184 | | | |
| 2185 | | | proto_tree_add_item(tipc_tree, hf_tipc_ack_link_lev_seq, tipc_tvb, offset, 4, FALSE); |
| 2186 | | | proto_tree_add_item(tipc_tree, hf_tipc_link_lev_seq, tipc_tvb, offset, 4, FALSE); |
| 2187 | | | offset = offset + 4; |
| 2188 | | | |
| 2189 | | | |
| 2190 | | | dword = tvb_get_ntohl(tipc_tvb, offset); |
| 2191 | | | addr_str_ptr = tipc_addr_to_str(dword); |
| 2192 | | | proto_tree_add_string(tipc_tree, hf_tipc_prev_proc, tipc_tvb, offset, 4, addr_str_ptr); |
| 2193 | | | |
| 2194 | | | offset = offset + 4; |
| 2195 | | | switch (user) { |
Event 13:
Executing default case.
hide
|
|
| 2196 | | | case TIPC_ROUTING_MANAGER: |
| 2197 | | | case TIPC_LINK_PROTOCOL: |
| 2198 | | | case TIPC_CHANGEOVER_PROTOCOL: |
| 2199 | | | case TIPC_SEGMENTATION_MANAGER: |
| 2200 | | | case TIPC_MSG_BUNDLER: |
| 2201 | | | dissect_tipc_int_prot_msg(tipc_tvb, pinfo, tipc_tree, offset, user, msg_size); |
| 2202 | | | return; |
| 2203 | | | default: |
| 2204 | | | break; |
| 2205 | | | } |
| 2206 | | | |
| 2207 | | | dword = tvb_get_ntohl(tipc_tvb, offset); |
| 2208 | | | pinfo->ptype = PT_TIPC; |
| 2209 | | | pinfo->srcport = dword; |
| 2210 | | | proto_tree_add_item(tipc_tree, hf_tipc_org_port, tipc_tvb, offset, 4, FALSE); |
| 2211 | | | offset = offset + 4; |
| 2212 | | | if (user != TIPC_NAME_DISTRIBUTOR) { |
Event 14:
Taking true branch. user != 9 evaluates to true.
hide
|
|
| 2213 | | | dword = tvb_get_ntohl(tipc_tvb, offset); |
| 2214 | | | pinfo->destport = dword; |
| 2215 | | | proto_tree_add_item(tipc_tree, hf_tipc_dst_port, tipc_tvb, offset, 4, FALSE); |
| 2216 | | | } |
| 2217 | | | offset = offset + 4; |
| 2218 | | | |
| 2219 | | | |
| 2220 | | | |
| 2221 | | | |
| 2222 | | | |
| 2223 | | | |
| 2224 | | | |
| 2225 | | | |
| 2226 | | | |
| 2227 | | | |
| 2228 | | | |
| 2229 | | | |
| 2230 | | | |
| 2231 | | | |
| 2232 | | | if (hdr_size <= 6) { |
Event 15:
Taking false branch. hdr_size <= 6 evaluates to false.
hide
|
|
| 2233 | | | proto_tree_add_text(tipc_tree, tipc_tvb, offset, -1, "%u bytes Data", (msg_size - hdr_size*4)); |
| 2234 | | | } else { |
| 2235 | | | switch (user) { |
Event 16:
Executing default case.
hide
|
|
| 2236 | | | case TIPC_NAME_DISTRIBUTOR: |
| 2237 | | | proto_tree_add_item(tipc_tree, hf_tipc_nd_msg_type, tipc_tvb, offset, 4, FALSE); |
| 2238 | | | break; |
| 2239 | | | case TIPC_CONNECTION_MANAGER: |
| 2240 | | | proto_tree_add_item(tipc_tree, hf_tipc_cm_msg_type, tipc_tvb, offset, 4, FALSE); |
| 2241 | | | break; |
| 2242 | | | default: |
| 2243 | | | proto_tree_add_item(tipc_tree, hf_tipc_data_msg_type, tipc_tvb, offset, 4, FALSE); |
| 2244 | | | break; |
| 2245 | | | } |
| 2246 | | | proto_tree_add_item(tipc_tree, hf_tipc_err_code, tipc_tvb, offset, 4, FALSE); |
| 2247 | | | proto_tree_add_item(tipc_tree, hf_tipc_reroute_cnt, tipc_tvb, offset, 4, FALSE); |
| 2248 | | | proto_tree_add_item(tipc_tree, hf_tipc_act_id, tipc_tvb, offset, 4, FALSE); |
| 2249 | | | offset = offset + 4; |
| 2250 | | | |
| 2251 | | | dword = tvb_get_ntohl(tipc_tvb, offset); |
| 2252 | | | addr_str_ptr = tipc_addr_to_str(dword); |
| 2253 | | | |
| 2254 | | | proto_tree_add_string(tipc_tree, hf_tipc_org_proc, tipc_tvb, offset, 4, addr_str_ptr); |
| 2255 | | | offset = offset + 4; |
| 2256 | | | |
| 2257 | | | dword = tvb_get_ntohl(tipc_tvb, offset); |
| 2258 | | | addr_str_ptr = tipc_addr_to_str(dword); |
| 2259 | | | |
| 2260 | | | proto_tree_add_string(tipc_tree, hf_tipc_dst_proc, tipc_tvb, offset, 4, addr_str_ptr); |
| 2261 | | | offset = offset + 4; |
| 2262 | | | |
| 2263 | | | |
| 2264 | | | |
| 2265 | | | |
| 2266 | | | if (hdr_size > 8) { |
Event 17:
Skipping " if". hdr_size > 8 evaluates to false.
hide
|
|
| 2267 | | | if (user == TIPC_NAME_DISTRIBUTOR) { |
| 2268 | | | |
| 2269 | | | |
| 2270 | | | |
| 2271 | | | |
| 2272 | | | |
| 2273 | | | |
| 2274 | | | |
| 2275 | | | offset = offset + 8; |
| 2276 | | | tipc_data_item = proto_tree_add_text(tipc_tree, tvb, offset, -1, "TIPC_NAME_DISTRIBUTOR %u bytes User Data", (msg_size - hdr_size*4)); |
| 2277 | | | tipc_data_tree = proto_item_add_subtree(tipc_data_item , ett_tipc_data); |
| 2278 | | | data_tvb = tvb_new_subset(tipc_tvb, offset, -1, -1); |
| 2279 | | | dissect_tipc_name_dist_data(data_tvb, tipc_data_tree, 0); |
| 2280 | | | return; |
| 2281 | | | } else { |
| 2282 | | | |
| 2283 | | | proto_tree_add_text(tipc_tree, tipc_tvb, offset, 4, "Port name type / Connection level sequence number"); |
| 2284 | | | offset = offset + 4; |
| 2285 | | | |
| 2286 | | | proto_tree_add_text(tipc_tree, tipc_tvb, offset, 4, "Port name instance"); |
| 2287 | | | offset = offset + 4; |
| 2288 | | | } |
| 2289 | | | } |
| 2290 | | | |
| 2291 | | | if (user < 4 && dissect_tipc_data) { |
| 2292 | | | tvbuff_t *next_tvb; |
| 2293 | | | guint32 *name_type_p = (guint32*)&msg_type; |
Event 19:
name_type_p is set to &msg_type. - This points to the buffer that will be overrun later.
hide
|
|
| 2294 | | | switch (msg_type) { |
Event 20:
msg_type evaluates to 3.
hide
|
|
| 2295 | | | case TIPC_CONNECTED_MSG: |
| 2296 | | | proto_tree_add_text(tipc_tree, tipc_tvb, offset, -1, "%u bytes Data", (msg_size - hdr_size*4)); |
| 2297 | | | break; |
| 2298 | | | case TIPC_NAMED_MSG: |
| 2299 | | | data_tvb = tvb_new_subset(tipc_tvb, offset+14, -1, -1); |
| 2300 | | | proto_tree_add_text(tipc_tree, tipc_tvb, offset, 14, "TIPC_NAMED_MSG Hdr"); |
| 2301 | | | proto_tree_add_text(tipc_tree, data_tvb, 0, -1, "%u bytes Data", (msg_size - hdr_size*4)); |
| 2302 | | | break; |
| 2303 | | | case TIPC_DIRECT_MSG: |
| 2304 | | | proto_tree_add_text(tipc_tree, tipc_tvb, offset, -1, "%u bytes Data", (msg_size - hdr_size*4)); |
| 2305 | | | break; |
| 2306 | | | default: |
| 2307 | | | proto_tree_add_text(tipc_tree, tipc_tvb, offset, -1, "%u bytes Data", (msg_size - hdr_size*4)); |
| 2308 | | | break; |
| 2309 | | | } |
| 2310 | | | |
| 2311 | | | next_tvb = tvb_new_subset(tvb, offset, -1, -1); |
| 2312 | [+] | | call_tipc_v2_data_subdissectors(next_tvb, pinfo, name_type_p, user); |
Event 21:
name_type_p, which evaluates to &msg_type, is passed to call_tipc_v2_data_subdissectors() as the third argument. See related event 19.
hide
|
|
 |
| |