(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smb-pipe.c) |
| |
| 3518 | | | dissect_pipe_smb(tvbuff_t *sp_tvb, tvbuff_t *s_tvb, tvbuff_t *pd_tvb, |
| 3519 | | | tvbuff_t *p_tvb, tvbuff_t *d_tvb, const char *pipe, |
| 3520 | | | packet_info *pinfo, proto_tree *tree) |
| 3521 | | | { |
| 3522 | | | smb_info_t *smb_info; |
| 3523 | | | smb_transact_info_t *tri; |
| 3524 | | | guint sp_len; |
| 3525 | | | proto_item *pipe_item = NULL; |
| 3526 | | | proto_tree *pipe_tree = NULL; |
| 3527 | | | int offset; |
| 3528 | | | int trans_subcmd=0; |
| 3529 | | | int function; |
| 3530 | | | int fid = -1; |
| 3531 | | | guint16 info_level; |
| 3532 | | | |
| 3533 | | | if (!proto_is_protocol_enabled(find_protocol_by_id(proto_smb_pipe))) |
Event 1:
Skipping " if". proto_is_protocol_enabled(...) evaluates to true.
hide
|
|
| 3534 | | | return FALSE; |
| 3535 | | | pinfo->current_proto = "SMB Pipe"; |
| 3536 | | | |
| 3537 | | | smb_info = pinfo->private_data; |
| 3538 | | | |
| 3539 | | | |
| 3540 | | | |
| 3541 | | | |
| 3542 | | | if (check_col(pinfo->cinfo, COL_PROTOCOL)) { |
Event 2:
Skipping " if". check_col(...) evaluates to false.
hide
|
|
| 3543 | | | col_set_str(pinfo->cinfo, COL_PROTOCOL, "SMB Pipe"); |
| 3544 | | | } |
| 3545 | | | if (check_col(pinfo->cinfo, COL_INFO)) { |
Event 3:
Skipping " if". check_col(...) evaluates to false.
hide
|
|
| 3546 | | | col_set_str(pinfo->cinfo, COL_INFO, |
| 3547 | | | smb_info->request ? "Request" : "Response"); |
| 3548 | | | } |
| 3549 | | | |
| 3550 | | | if (smb_info->sip != NULL && smb_info->sip-> == SMB_EI_TRI) |
| 3551 | | | tri = smb_info->sip->; |
| 3552 | | | else |
| 3553 | | | tri = NULL; |
| 3554 | | | |
| 3555 | | | |
| 3556 | | | |
| 3557 | | | |
| 3558 | | | |
| 3559 | | | if (sp_tvb != NULL) |
Event 5:
Taking true branch. sp_tvb != (void *)0 evaluates to true.
hide
|
|
| 3560 | | | sp_len = tvb_length(sp_tvb); |
| 3561 | | | else |
| 3562 | | | sp_len = 0; |
| 3563 | | | if (tree) { |
Event 6:
Skipping " if". tree evaluates to false.
hide
|
|
| 3564 | | | pipe_item = proto_tree_add_item(tree, proto_smb_pipe, |
| 3565 | | | sp_tvb, 0, sp_len, FALSE); |
| 3566 | | | pipe_tree = proto_item_add_subtree(pipe_item, ett_smb_pipe); |
| 3567 | | | } |
| 3568 | | | offset = 0; |
| 3569 | | | |
| 3570 | | | |
| 3571 | | | |
| 3572 | | | |
| 3573 | | | if (s_tvb != NULL && tvb_length(s_tvb) != 0) { |
| 3574 | | | |
| 3575 | | | |
| 3576 | | | |
| 3577 | | | function = tvb_get_letohs(s_tvb, offset); |
| 3578 | | | proto_tree_add_uint(pipe_tree, hf_pipe_function, s_tvb, |
| 3579 | | | offset, 2, function); |
| 3580 | | | offset += 2; |
| 3581 | | | if (check_col(pinfo->cinfo, COL_INFO)) { |
| 3582 | | | col_add_fstr(pinfo->cinfo, COL_INFO, "%s %s", |
| 3583 | | | val_to_str(function, functions, "Unknown function (0x%04x)"), |
| 3584 | | | smb_info->request ? "Request" : "Response"); |
| 3585 | | | } |
| 3586 | | | if (tri != NULL) |
| 3587 | | | tri->function = function; |
| 3588 | | | |
| 3589 | | | |
| 3590 | | | |
| 3591 | | | |
| 3592 | | | switch (function) { |
| 3593 | | | |
| 3594 | | | case CALL_NAMED_PIPE: |
| 3595 | | | case WAIT_NAMED_PIPE: |
| 3596 | | | |
| 3597 | | | |
| 3598 | | | |
| 3599 | | | proto_tree_add_item(pipe_tree, hf_pipe_priority, s_tvb, |
| 3600 | | | offset, 2, TRUE); |
| 3601 | | | break; |
| 3602 | | | |
| 3603 | | | case PEEK_NAMED_PIPE: |
| 3604 | | | case Q_NM_P_HAND_STATE: |
| 3605 | | | case SET_NM_P_HAND_STATE: |
| 3606 | | | case Q_NM_PIPE_INFO: |
| 3607 | | | case TRANSACT_NM_PIPE: |
| 3608 | | | case RAW_READ_NM_PIPE: |
| 3609 | | | case RAW_WRITE_NM_PIPE: |
| 3610 | | | |
| 3611 | | | |
| 3612 | | | |
| 3613 | | | fid = tvb_get_letohs(s_tvb, 2); |
| 3614 | | | dissect_smb_fid(s_tvb, pinfo, pipe_tree, offset, 2, (guint16) fid, FALSE, FALSE, FALSE); |
| 3615 | | | if (tri != NULL) |
| 3616 | | | tri->fid = fid; |
| 3617 | | | break; |
| 3618 | | | |
| 3619 | | | default: |
| 3620 | | | |
| 3621 | | | |
| 3622 | | | |
| 3623 | | | |
| 3624 | | | break; |
| 3625 | | | } |
| 3626 | | | offset += 2; |
| 3627 | | | } else { |
| 3628 | | | |
| 3629 | | | |
| 3630 | | | |
| 3631 | | | |
| 3632 | | | |
| 3633 | | | |
| 3634 | | | |
| 3635 | | | |
| 3636 | | | |
| 3637 | | | if (tri != NULL && tri->function != -1) { |
| 3638 | | | function = tri->function; |
| 3639 | | | proto_tree_add_uint(pipe_tree, hf_pipe_function, NULL, |
| 3640 | | | 0, 0, function); |
| 3641 | | | if (check_col(pinfo->cinfo, COL_INFO)) { |
| 3642 | | | col_add_fstr(pinfo->cinfo, COL_INFO, "%s %s", |
| 3643 | | | val_to_str(function, functions, "Unknown function (0x%04x)"), |
| 3644 | | | smb_info->request ? "Request" : "Response"); |
| 3645 | | | } |
| 3646 | | | fid = tri->fid; |
| 3647 | | | if (fid != -1) |
| 3648 | | | dissect_smb_fid(d_tvb, pinfo, pipe_tree, 0, 0, (guint16) fid, FALSE, FALSE, TRUE); |
| 3649 | | | } else { |
| 3650 | | | function = -1; |
| 3651 | | | fid = -1; |
| 3652 | | | } |
| 3653 | | | } |
| 3654 | | | |
| 3655 | | | |
| 3656 | | | |
| 3657 | | | |
| 3658 | | | |
| 3659 | | | |
| 3660 | | | if(smb_info->request){ |
Event 9:
Taking false branch. smb_info->request evaluates to false.
hide
|
|
| 3661 | | | if(strncmp(pipe,"LANMAN",6) == 0){ |
| 3662 | | | trans_subcmd=PIPE_LANMAN; |
| 3663 | | | } else { |
| 3664 | | | |
| 3665 | | | trans_subcmd=PIPE_DCERPC; |
| 3666 | | | } |
| 3667 | | | |
| 3668 | | | if (!pinfo->fd->flags.visited) { |
| 3669 | | | if (tri == NULL) |
| 3670 | | | return FALSE; |
| 3671 | | | tri->trans_subcmd = trans_subcmd; |
| 3672 | | | } |
| 3673 | | | } else { |
| 3674 | | | if(tri == NULL) |
Event 10:
Skipping " if". tri == (void *)0 evaluates to false.
hide
|
|
| 3675 | | | return FALSE; |
| 3676 | | | trans_subcmd = tri->trans_subcmd; |
| 3677 | | | } |
| 3678 | | | |
| 3679 | | | if (tri == NULL) { |
Null Test After Dereference
This code tests the nullness of tri, which has already been dereferenced. - If tri were null, there would have been a prior null pointer dereference at packet-smb-pipe.c:3676, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 11. Show: All events | Only primary events |
|
| 3680 | | | |
| 3681 | | | |
| 3682 | | | |
| 3683 | | | |
| 3684 | | | return FALSE; |
| 3685 | | | } |
| 3686 | | | |
| 3687 | | | switch (function) { |
| 3688 | | | |
| 3689 | | | case CALL_NAMED_PIPE: |
| 3690 | | | case TRANSACT_NM_PIPE: |
| 3691 | | | switch(trans_subcmd){ |
| 3692 | | | |
| 3693 | | | case PIPE_LANMAN: |
| 3694 | | | return dissect_pipe_lanman(pd_tvb, p_tvb, d_tvb, pinfo, |
| 3695 | | | tree); |
| 3696 | | | |
| 3697 | | | case PIPE_DCERPC: |
| 3698 | | | |
| 3699 | | | |
| 3700 | | | |
| 3701 | | | if (fid != -1) { |
| 3702 | | | if (d_tvb == NULL) |
| 3703 | | | return FALSE; |
| 3704 | | | return dissect_pipe_dcerpc(d_tvb, pinfo, tree, |
| 3705 | | | pipe_tree, fid); |
| 3706 | | | } |
| 3707 | | | break; |
| 3708 | | | } |
| 3709 | | | break; |
| 3710 | | | |
| 3711 | | | case -1: |
| 3712 | | | |
| 3713 | | | |
| 3714 | | | |
| 3715 | | | |
| 3716 | | | switch(trans_subcmd){ |
| 3717 | | | case PIPE_LANMAN: |
| 3718 | | | return dissect_pipe_lanman(pd_tvb, p_tvb, d_tvb, pinfo, |
| 3719 | | | tree); |
| 3720 | | | } |
| 3721 | | | break; |
| 3722 | | | |
| 3723 | | | case WAIT_NAMED_PIPE: |
| 3724 | | | break; |
| 3725 | | | |
| 3726 | | | case PEEK_NAMED_PIPE: |
| 3727 | | | |
| 3728 | | | |
| 3729 | | | |
| 3730 | | | if (!smb_info->request) { |
| 3731 | | | if (p_tvb == NULL) |
| 3732 | | | return FALSE; |
| 3733 | | | offset = 0; |
| 3734 | | | proto_tree_add_item(pipe_tree, hf_pipe_peek_available, |
| 3735 | | | p_tvb, offset, 2, TRUE); |
| 3736 | | | offset += 2; |
| 3737 | | | proto_tree_add_item(pipe_tree, hf_pipe_peek_remaining, |
| 3738 | | | p_tvb, offset, 2, TRUE); |
| 3739 | | | offset += 2; |
| 3740 | | | proto_tree_add_item(pipe_tree, hf_pipe_peek_status, |
| 3741 | | | p_tvb, offset, 2, TRUE); |
| 3742 | | | offset += 2; |
| 3743 | | | } |
| 3744 | | | break; |
| 3745 | | | |
| 3746 | | | case Q_NM_P_HAND_STATE: |
| 3747 | | | |
| 3748 | | | |
| 3749 | | | |
| 3750 | | | if (!smb_info->request) { |
| 3751 | | | if (p_tvb == NULL) |
| 3752 | | | return FALSE; |
| 3753 | | | offset = dissect_ipc_state(p_tvb, pipe_tree, 0, FALSE); |
| 3754 | | | } |
| 3755 | | | break; |
| 3756 | | | |
| 3757 | | | case SET_NM_P_HAND_STATE: |
| 3758 | | | |
| 3759 | | | |
| 3760 | | | |
| 3761 | | | if (smb_info->request) { |
| 3762 | | | if (p_tvb == NULL) |
| 3763 | | | return FALSE; |
| 3764 | | | offset = dissect_ipc_state(p_tvb, pipe_tree, 0, TRUE); |
| 3765 | | | } |
| 3766 | | | break; |
| 3767 | | | |
| 3768 | | | case Q_NM_PIPE_INFO: |
| 3769 | | | offset = 0; |
| 3770 | | | if (smb_info->request) { |
| 3771 | | | if (p_tvb == NULL) |
| 3772 | | | return FALSE; |
| 3773 | | | |
| 3774 | | | |
| 3775 | | | |
| 3776 | | | |
| 3777 | | | info_level = tvb_get_letohs(p_tvb, offset); |
| 3778 | | | proto_tree_add_uint(pipe_tree, hf_pipe_getinfo_info_level, |
| 3779 | | | p_tvb, offset, 2, info_level); |
| 3780 | | | offset += 2; |
| 3781 | | | if (!pinfo->fd->flags.visited) |
| 3782 | | | tri->info_level = info_level; |
| 3783 | | | } else { |
| 3784 | | | guint8 pipe_namelen; |
| 3785 | | | |
| 3786 | | | if (d_tvb == NULL) |
| 3787 | | | return FALSE; |
| 3788 | | | |
| 3789 | | | switch (tri->info_level) { |
| 3790 | | | |
| 3791 | | | case 1: |
| 3792 | | | proto_tree_add_item(pipe_tree, |
| 3793 | | | hf_pipe_getinfo_output_buffer_size, |
| 3794 | | | d_tvb, offset, 2, TRUE); |
| 3795 | | | offset += 2; |
| 3796 | | | proto_tree_add_item(pipe_tree, |
| 3797 | | | hf_pipe_getinfo_input_buffer_size, |
| 3798 | | | d_tvb, offset, 2, TRUE); |
| 3799 | | | offset += 2; |
| 3800 | | | proto_tree_add_item(pipe_tree, |
| 3801 | | | hf_pipe_getinfo_maximum_instances, |
| 3802 | | | d_tvb, offset, 1, TRUE); |
| 3803 | | | offset += 1; |
| 3804 | | | proto_tree_add_item(pipe_tree, |
| 3805 | | | hf_pipe_getinfo_current_instances, |
| 3806 | | | d_tvb, offset, 1, TRUE); |
| 3807 | | | offset += 1; |
| 3808 | | | pipe_namelen = tvb_get_guint8(d_tvb, offset); |
| 3809 | | | proto_tree_add_uint(pipe_tree, |
| 3810 | | | hf_pipe_getinfo_pipe_name_length, |
| 3811 | | | d_tvb, offset, 1, pipe_namelen); |
| 3812 | | | offset += 1; |
| 3813 | | | |
| 3814 | | | proto_tree_add_item(pipe_tree, |
| 3815 | | | hf_pipe_getinfo_pipe_name, |
| 3816 | | | d_tvb, offset, pipe_namelen, TRUE); |
| 3817 | | | break; |
| 3818 | | | } |
| 3819 | | | } |
| 3820 | | | break; |
| 3821 | | | |
| 3822 | | | case RAW_READ_NM_PIPE: |
| 3823 | | | |
| 3824 | | | |
| 3825 | | | |
| 3826 | | | if (!smb_info->request) { |
| 3827 | | | if (d_tvb == NULL) |
| 3828 | | | return FALSE; |
| 3829 | | | |
| 3830 | | | offset = dissect_file_data(d_tvb, pipe_tree, 0, |
| 3831 | | | (guint16) tvb_reported_length(d_tvb), |
| 3832 | | | (guint16) tvb_reported_length(d_tvb)); |
| 3833 | | | } |
| 3834 | | | break; |
| 3835 | | | |
| 3836 | | | case RAW_WRITE_NM_PIPE: |
| 3837 | | | offset = 0; |
| 3838 | | | if (smb_info->request) { |
| 3839 | | | if (d_tvb == NULL) |
| 3840 | | | return FALSE; |
| 3841 | | | |
| 3842 | | | offset = dissect_file_data(d_tvb, pipe_tree, |
| 3843 | | | offset, (guint16) tvb_reported_length(d_tvb), |
| 3844 | | | (guint16) tvb_reported_length(d_tvb)); |
| 3845 | | | } else { |
| 3846 | | | if (p_tvb == NULL) |
| 3847 | | | return FALSE; |
| 3848 | | | proto_tree_add_item(pipe_tree, |
| 3849 | | | hf_pipe_write_raw_bytes_written, |
| 3850 | | | p_tvb, offset, 2, TRUE); |
| 3851 | | | offset += 2; |
| 3852 | | | } |
| 3853 | | | break; |
| 3854 | | | } |
| 3855 | | | return TRUE; |
| 3856 | | | } |
| |