(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-fcp.c) |
| |
| 395 | | | dissect_fcp_cmnd(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, proto_tree *tree, conversation_t *conversation, fc_hdr *fchdr, fcp_conv_data_t *fcp_conv_data) |
| 396 | | | { |
| 397 | | | int offset = 0; |
| 398 | | | int len, |
| 399 | | | add_len = 0; |
| 400 | | | guint8 flags, rwflags, lun0; |
| 401 | | | guint16 lun=0xffff; |
| 402 | | | tvbuff_t *cdb_tvb; |
| 403 | | | int tvb_len, tvb_rlen; |
| 404 | | | itl_nexus_t *itl=NULL; |
| 405 | | | proto_item *hidden_item; |
| 406 | | | |
| 407 | | | |
| 408 | | | flags = tvb_get_guint8 (tvb, offset+10); |
| 409 | | | if (flags) { |
Event 1:
Taking false branch. flags evaluates to false.
hide
|
|
| 410 | | | add_len = tvb_get_guint8 (tvb, offset+11) & 0x7C; |
| 411 | | | add_len = add_len >> 2; |
| 412 | | | |
| 413 | | | len = FCP_DEF_CMND_LEN + add_len; |
| 414 | | | } |
| 415 | | | else { |
| 416 | | | len = FCP_DEF_CMND_LEN; |
| 417 | | | } |
| 418 | | | |
| 419 | | | hidden_item = proto_tree_add_uint(tree, hf_fcp_type, tvb, offset, 0, 0); |
| 420 | | | PROTO_ITEM_SET_HIDDEN(hidden_item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
319 | #define PROTO_ITEM_SET_HIDDEN(proto_item) \ |
320 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_HIDDEN) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
Event 2:
hidden_item evaluates to true.
hide
|
|
| 421 | | | |
| 422 | | | lun0 = tvb_get_guint8 (tvb, offset); |
| 423 | | | |
| 424 | | | |
| 425 | | | |
| 426 | | | |
| 427 | | | |
| 428 | | | |
| 429 | | | if (lun0) { |
Event 3:
Taking false branch. lun0 evaluates to false.
hide
|
|
| 430 | | | proto_tree_add_item(tree, hf_fcp_multilun, tvb, offset, 8, 0); |
| 431 | | | lun=tvb_get_guint8(tvb, offset)&0x3f; |
| 432 | | | lun<<=8; |
| 433 | | | lun|=tvb_get_guint8(tvb, offset+1); |
| 434 | | | } else { |
| 435 | | | proto_tree_add_item(tree, hf_fcp_singlelun, tvb, offset+1, |
| 436 | | | 1, 0); |
| 437 | | | lun=tvb_get_guint8(tvb, offset+1); |
| 438 | | | } |
| 439 | | | |
| 440 | | | if (fchdr->itlq) |
Event 4:
Taking true branch. fchdr->itlq evaluates to true.
hide
|
|
| 441 | | | fchdr->itlq->lun=lun; |
| 442 | | | |
| 443 | | | itl=(itl_nexus_t *)se_tree_lookup32(fcp_conv_data->luns, lun); |
| 444 | | | if(!itl){ |
Event 5:
Skipping " if". itl evaluates to true.
hide
|
|
| 445 | | | itl=se_alloc(sizeof(itl_nexus_t)); |
| 446 | | | itl->cmdset=0xff; |
| 447 | | | itl->conversation=conversation; |
| 448 | | | se_tree_insert32(fcp_conv_data->luns, lun, itl); |
| 449 | | | } |
| 450 | | | |
| 451 | | | proto_tree_add_item(tree, hf_fcp_crn, tvb, offset+8, 1, 0); |
| 452 | | | proto_tree_add_item(tree, hf_fcp_taskattr, tvb, offset+9, 1, 0); |
| 453 | | | dissect_task_mgmt_flags(pinfo, tree, tvb, offset+10); |
| 454 | | | proto_tree_add_item(tree, hf_fcp_addlcdblen, tvb, offset+11, 1, 0); |
| 455 | | | rwflags=tvb_get_guint8(tvb, offset+11); |
| 456 | | | if(fchdr->itlq){ |
Event 6:
Taking true branch. fchdr->itlq evaluates to true.
hide
|
|
| 457 | | | if(rwflags&0x02){ |
Event 7:
Taking true branch. rwflags & 2 evaluates to true.
hide
|
|
| 458 | | | fchdr->itlq->task_flags|=SCSI_DATA_READ; |
| 459 | | | } |
| 460 | | | if(rwflags&0x01){ |
Event 9:
Skipping " if". rwflags & 1 evaluates to false.
hide
|
|
| 461 | | | fchdr->itlq->task_flags|=SCSI_DATA_WRITE; |
| 462 | | | } |
| 463 | | | } |
| 464 | | | proto_tree_add_item(tree, hf_fcp_rddata, tvb, offset+11, 1, 0); |
| 465 | | | proto_tree_add_item(tree, hf_fcp_wrdata, tvb, offset+11, 1, 0); |
| 466 | | | |
| 467 | | | tvb_len=tvb_length_remaining(tvb, offset+12); |
| 468 | | | if(tvb_len>(16+add_len)) |
Event 10:
Skipping " if". tvb_len > 16 + add_len evaluates to false.
hide
|
|
| 469 | | | tvb_len=16+add_len; |
| 470 | | | tvb_rlen=tvb_reported_length_remaining(tvb, offset+12); |
| 471 | | | if(tvb_rlen>(16+add_len)) |
Event 11:
Skipping " if". tvb_rlen > 16 + add_len evaluates to false.
hide
|
|
| 472 | | | tvb_rlen=16+add_len; |
| 473 | | | cdb_tvb=tvb_new_subset(tvb, offset+12, tvb_len, tvb_rlen); |
| 474 | | | dissect_scsi_cdb(cdb_tvb, pinfo, parent_tree, SCSI_DEV_UNKNOWN, fchdr->itlq, itl); |
| 475 | | | |
| 476 | | | proto_tree_add_item(tree, hf_fcp_dl, tvb, offset+12+16+add_len, |
| 477 | | | 4, 0); |
| 478 | | | if(fchdr->itlq){ |
Null Test After Dereference
This code tests the nullness of fchdr->itlq, which has already been dereferenced. - If fchdr->itlq were null, there would have been a prior null pointer dereference at packet-fcp.c:458, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 8. Show: All events | Only primary events |
|
| 479 | | | fchdr->itlq->data_length=tvb_get_ntohl(tvb, offset+12+16+add_len); |
| 480 | | | } |
| 481 | | | |
| 482 | | | if( ((rwflags&0x03)==0x03) |
| 483 | | | && tvb_length_remaining(tvb, offset+12+16+add_len+4)>=4){ |
| 484 | | | proto_tree_add_item(tree, hf_fcp_bidir_dl, tvb, offset+12+16+add_len+4, |
| 485 | | | 4, 0); |
| 486 | | | if(fchdr->itlq){ |
| 487 | | | fchdr->itlq->bidir_data_length=tvb_get_ntohl(tvb, offset+12+16+add_len+4); |
| 488 | | | } |
| 489 | | | |
| 490 | | | } |
| 491 | | | |
| 492 | | | } |
| |