(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-bacapp.c) |
| |
| 6154 | | | dissect_bacapp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) |
| 6155 | | | { |
| 6156 | | | gint8 tmp, bacapp_type; |
| 6157 | | | tvbuff_t *next_tvb; |
| 6158 | | | guint offset = 0; |
| 6159 | | | guint8 bacapp_service, bacapp_reason; |
| 6160 | | | guint8 bacapp_invoke_id; |
| 6161 | | | proto_item *ti; |
| 6162 | | | proto_tree *bacapp_tree; |
| 6163 | | | |
| 6164 | | | if (check_col(pinfo->cinfo, COL_PROTOCOL)) |
| 6165 | | | col_set_str(pinfo->cinfo, COL_PROTOCOL, "BACnet-APDU"); |
| 6166 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
| 6167 | | | col_set_str(pinfo->cinfo, COL_INFO, "BACnet APDU "); |
| 6168 | | | |
| 6169 | | | tmp = (gint) tvb_get_guint8(tvb, 0); |
| 6170 | | | bacapp_type = (tmp >> 4) & 0x0f; |
| 6171 | | | |
| 6172 | | | |
| 6173 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
| 6174 | | | { |
| 6175 | | | col_clear(pinfo->cinfo, COL_INFO); |
| 6176 | | | col_add_str(pinfo->cinfo, COL_INFO, |
| 6177 | | | val_to_str(bacapp_type, BACnetTypeName, "#### unknown APDU ##### ")); |
| 6178 | | | switch (bacapp_type) |
| 6179 | | | { |
| 6180 | | | case BACAPP_TYPE_CONFIRMED_SERVICE_REQUEST: |
| 6181 | | | |
| 6182 | | | if (tmp & BACAPP_SEGMENTED_REQUEST) |
| 6183 | | | { |
| 6184 | | | bacapp_invoke_id = tvb_get_guint8(tvb, offset + 4); |
| 6185 | | | bacapp_service = tvb_get_guint8(tvb, offset + 5); |
| 6186 | | | } |
| 6187 | | | else |
| 6188 | | | { |
| 6189 | | | bacapp_invoke_id = tvb_get_guint8(tvb, offset + 2); |
| 6190 | | | bacapp_service = tvb_get_guint8(tvb, offset + 3); |
| 6191 | | | } |
| 6192 | | | col_append_fstr(pinfo->cinfo, COL_INFO, "[invoke:%d]: %s", |
| 6193 | | | bacapp_invoke_id, |
| 6194 | | | val_to_str(bacapp_service, |
| 6195 | | | BACnetConfirmedServiceChoice, |
| 6196 | | | bacapp_unknown_service_str)); |
| 6197 | | | break; |
| 6198 | | | case BACAPP_TYPE_UNCONFIRMED_SERVICE_REQUEST: |
| 6199 | | | bacapp_service = tvb_get_guint8(tvb, offset + 1); |
| 6200 | | | col_append_fstr(pinfo->cinfo, COL_INFO, ": %s", |
| 6201 | | | val_to_str(bacapp_service, |
| 6202 | | | BACnetUnconfirmedServiceChoice, |
| 6203 | | | bacapp_unknown_service_str)); |
Format String
val_to_str() is being called with a format string that is not constant. The format string (third argument) may not match the other arguments to val_to_str(); this could lead to security or stability problems. val_to_str() is usually called with strings that look like format strings in this project. |
|
| 6204 | | | break; |
| 6205 | | | case BACAPP_TYPE_SIMPLE_ACK: |
| 6206 | | | bacapp_invoke_id = tvb_get_guint8(tvb, offset + 1); |
| 6207 | | | bacapp_service = tvb_get_guint8(tvb, offset + 2); |
| 6208 | | | col_append_fstr(pinfo->cinfo, COL_INFO, "[invoke:%d]: %s", |
| 6209 | | | bacapp_invoke_id, |
| 6210 | | | val_to_str(bacapp_service, |
| 6211 | | | BACnetConfirmedServiceChoice, |
| 6212 | | | bacapp_unknown_service_str)); |
| 6213 | | | break; |
| 6214 | | | case BACAPP_TYPE_COMPLEX_ACK: |
| 6215 | | | |
| 6216 | | | if (tmp & BACAPP_SEGMENTED_REQUEST) |
| 6217 | | | { |
| 6218 | | | bacapp_invoke_id = tvb_get_guint8(tvb, offset + 3); |
| 6219 | | | bacapp_service = tvb_get_guint8(tvb, offset + 4); |
| 6220 | | | } |
| 6221 | | | else |
| 6222 | | | { |
| 6223 | | | bacapp_invoke_id = tvb_get_guint8(tvb, offset + 1); |
| 6224 | | | bacapp_service = tvb_get_guint8(tvb, offset + 2); |
| 6225 | | | } |
| 6226 | | | col_append_fstr(pinfo->cinfo, COL_INFO, "[invoke:%d]: %s", |
| 6227 | | | bacapp_invoke_id, |
| 6228 | | | val_to_str(bacapp_service, |
| 6229 | | | BACnetConfirmedServiceChoice, |
| 6230 | | | bacapp_unknown_service_str)); |
| 6231 | | | break; |
| 6232 | | | case BACAPP_TYPE_SEGMENT_ACK: |
| 6233 | | | |
| 6234 | | | break; |
| 6235 | | | case BACAPP_TYPE_ERROR: |
| 6236 | | | bacapp_invoke_id = tvb_get_guint8(tvb, offset + 1); |
| 6237 | | | bacapp_service = tvb_get_guint8(tvb, offset + 2); |
| 6238 | | | col_append_fstr(pinfo->cinfo, COL_INFO, "[invoke:%d]: %s", |
| 6239 | | | bacapp_invoke_id, |
| 6240 | | | val_to_str(bacapp_service, |
| 6241 | | | BACnetConfirmedServiceChoice, |
| 6242 | | | bacapp_unknown_service_str)); |
| 6243 | | | break; |
| 6244 | | | case BACAPP_TYPE_REJECT: |
| 6245 | | | bacapp_invoke_id = tvb_get_guint8(tvb, offset + 1); |
| 6246 | | | bacapp_reason = tvb_get_guint8(tvb, offset + 2); |
| 6247 | | | col_append_fstr(pinfo->cinfo, COL_INFO, "[invoke:%d]: %s", |
| 6248 | | | bacapp_invoke_id, |
| 6249 | | | val_to_split_str(bacapp_reason, |
| 6250 | | | 64, |
| 6251 | | | BACnetRejectReason, |
| 6252 | | | ASHRAE_Reserved_Fmt, |
| 6253 | | | Vendor_Proprietary_Fmt)); |
| 6254 | | | break; |
| 6255 | | | case BACAPP_TYPE_ABORT: |
| 6256 | | | bacapp_invoke_id = tvb_get_guint8(tvb, offset + 1); |
| 6257 | | | bacapp_reason = tvb_get_guint8(tvb, offset + 2); |
| 6258 | | | col_append_fstr(pinfo->cinfo, COL_INFO, "[invoke:%d]: %s", |
| 6259 | | | bacapp_invoke_id, |
| 6260 | | | val_to_split_str(bacapp_reason, |
| 6261 | | | 64, |
| 6262 | | | BACnetAbortReason, |
| 6263 | | | ASHRAE_Reserved_Fmt, |
| 6264 | | | Vendor_Proprietary_Fmt)); |
| 6265 | | | break; |
| 6266 | | | |
| 6267 | | | default: |
| 6268 | | | |
| 6269 | | | break; |
| 6270 | | | } |
| 6271 | | | } |
| 6272 | | | |
| 6273 | | | if (tree) { |
| 6274 | | | ti = proto_tree_add_item(tree, proto_bacapp, tvb, offset, -1, FALSE); |
| 6275 | | | bacapp_tree = proto_item_add_subtree(ti, ett_bacapp); |
| 6276 | | | |
| 6277 | | | |
| 6278 | | | switch (bacapp_type) { |
| 6279 | | | case BACAPP_TYPE_CONFIRMED_SERVICE_REQUEST: |
| 6280 | | | offset = fConfirmedRequestPDU(tvb, bacapp_tree, offset); |
| 6281 | | | break; |
| 6282 | | | case BACAPP_TYPE_UNCONFIRMED_SERVICE_REQUEST: |
| 6283 | | | offset = fUnconfirmedRequestPDU(tvb, bacapp_tree, offset); |
| 6284 | | | break; |
| 6285 | | | case BACAPP_TYPE_SIMPLE_ACK: |
| 6286 | | | offset = fSimpleAckPDU(tvb, bacapp_tree, offset); |
| 6287 | | | break; |
| 6288 | | | case BACAPP_TYPE_COMPLEX_ACK: |
| 6289 | | | offset = fComplexAckPDU(tvb, bacapp_tree, offset); |
| 6290 | | | break; |
| 6291 | | | case BACAPP_TYPE_SEGMENT_ACK: |
| 6292 | | | offset = fSegmentAckPDU(tvb, bacapp_tree, offset); |
| 6293 | | | break; |
| 6294 | | | case BACAPP_TYPE_ERROR: |
| 6295 | | | offset = fErrorPDU(tvb, bacapp_tree, offset); |
| 6296 | | | break; |
| 6297 | | | case BACAPP_TYPE_REJECT: |
| 6298 | | | offset = fRejectPDU(tvb, bacapp_tree, offset); |
| 6299 | | | break; |
| 6300 | | | case BACAPP_TYPE_ABORT: |
| 6301 | | | offset = fAbortPDU(tvb, bacapp_tree, offset); |
| 6302 | | | break; |
| 6303 | | | } |
| 6304 | | | } |
| 6305 | | | |
| 6306 | | | next_tvb = tvb_new_subset(tvb,offset,-1,tvb_length_remaining(tvb,offset)); |
| 6307 | | | call_dissector(data_handle,next_tvb, pinfo, tree); |
| 6308 | | | } |
| |