(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-beep.c) |
| |
| 535 | | | dissect_beep_tree(tvbuff_t *tvb, int offset, packet_info *pinfo, |
| 536 | | | proto_tree *tree, struct beep_request_val *request_val, |
| 537 | | | struct beep_proto_data *beep_frame_data) |
| 538 | | | { |
| 539 | | | proto_tree *ti = NULL, *hdr = NULL; |
| 540 | | | proto_item *hidden_item; |
| 541 | | | int st_offset, msgno, ansno, seqno, size, channel, ackno, window, cc, |
| 542 | | | more; |
| 543 | | | |
| 544 | | | const char * cmd_temp = NULL; |
| 545 | | | int is_ANS = 0; |
| 546 | | | st_offset = offset; |
| 547 | | | |
| 548 | | | if (tvb_strneql(tvb, offset, "MSG ", 4) == 0) |
Event 1:
Taking true branch. tvb_strneql(...) == 0 evaluates to true.
hide
|
|
| 549 | | | cmd_temp = "Command: MSG"; |
| 550 | | | if (tvb_strneql(tvb, offset, "RPY ", 4) == 0) |
Event 2:
Skipping " if". tvb_strneql(...) == 0 evaluates to false.
hide
|
|
| 551 | | | cmd_temp = "Command: RPY"; |
| 552 | | | if (tvb_strneql(tvb, offset, "ERR ", 4) == 0) |
Event 3:
Taking true branch. tvb_strneql(...) == 0 evaluates to true.
hide
|
|
| 553 | | | cmd_temp = "Command: ERR"; |
| 554 | | | if (tvb_strneql(tvb, offset, "NUL ", 4) == 0) |
Event 4:
Taking true branch. tvb_strneql(...) == 0 evaluates to true.
hide
|
|
| 555 | | | cmd_temp = "Command: NUL"; |
| 556 | | | if (tvb_strneql(tvb, offset, "ANS ", 4) == 0) { |
Event 5:
Skipping " if". tvb_strneql(...) == 0 evaluates to false.
hide
|
|
| 557 | | | cmd_temp = "Command: ANS"; |
| 558 | | | is_ANS = 1; |
| 559 | | | } |
| 560 | | | |
| 561 | | | if (cmd_temp != NULL) { |
Event 6:
Taking true branch. cmd_temp != (void *)0 evaluates to true.
hide
|
|
| 562 | | | |
| 563 | | | if (tree) { |
Event 7:
Skipping " if". tree evaluates to false.
hide
|
|
| 564 | | | ti = proto_tree_add_text(tree, tvb, offset, (tvb, offset) + 2, ""); |
| 565 | | | |
| 566 | | | hdr = proto_item_add_subtree(ti, ); |
| 567 | | | |
| 568 | | | hidden_item = proto_tree_add_boolean(hdr, hf_beep_req, tvb, offset, 3, TRUE); |
| 569 | | | proto_tree_add_text(hdr, tvb, offset, 3, "%s", cmd_temp); |
| 570 | | | } |
| 571 | | | |
| 572 | | | offset += 4; |
| 573 | | | |
| 574 | | | |
| 575 | | | offset += dissect_beep_int(tvb, offset, hdr, hf_beep_channel, &channel, req_chan_hfa); |
| 576 | | | offset += 1; |
| 577 | | | |
| 578 | | | |
| 579 | | | offset += dissect_beep_int(tvb, offset, hdr, hf_beep_msgno, &msgno, req_msgno_hfa); |
| 580 | | | offset += 1; |
| 581 | | | |
| 582 | | | |
| 583 | | | if ((more = dissect_beep_more(tvb, offset, hdr)) >= 0) { |
Event 8:
Taking true branch. (more = dissect_beep_more(...)) >= 0 evaluates to true.
hide
|
|
| 584 | | | |
| 585 | | | |
| 586 | | | |
| 587 | | | |
| 588 | | | set_mime_hdr_flags(more, request_val, beep_frame_data, pinfo); |
| 589 | | | } |
| 590 | | | else { |
| 591 | | | if (tree) { |
| 592 | | | proto_tree_add_text(hdr, tvb, offset, |
| 593 | | | tvb_length_remaining(tvb, offset), |
| 594 | | | "Undissected Payload: %s", |
| 595 | | | tvb_format_text(tvb, offset, |
| 596 | | | tvb_length_remaining(tvb, offset) |
| 597 | | | ) |
| 598 | | | ); |
| 599 | | | |
| 600 | | | } |
| 601 | | | return -1; |
| 602 | | | } |
| 603 | | | |
| 604 | | | offset += 2; |
| 605 | | | |
| 606 | | | |
| 607 | | | offset += dissect_beep_int(tvb, offset, hdr, hf_beep_seqno, &seqno, req_seqno_hfa); |
| 608 | | | offset += 1; |
| 609 | | | |
| 610 | | | offset += dissect_beep_int(tvb, offset, hdr, hf_beep_size, &size, req_size_hfa); |
| 611 | | | if (request_val) |
Event 9:
Taking true branch. request_val evaluates to true.
hide
|
|
| 612 | | | request_val -> size = size; |
| 613 | | | else { |
| 614 | | | beep_frame_data->pl_size = size; |
| 615 | | | if (beep_frame_data->pl_size < 0) beep_frame_data->pl_size = 0; |
| 616 | | | } |
| 617 | | | |
| 618 | | | |
| 619 | | | if (is_ANS) { |
Event 11:
Skipping " if". is_ANS evaluates to false.
hide
|
|
| 620 | | | offset += 1; |
| 621 | | | |
| 622 | | | offset += dissect_beep_int(tvb, offset, hdr, hf_beep_ansno, &ansno, req_ansno_hfa); |
| 623 | | | } |
| 624 | | | |
| 625 | | | if ((cc = check_term(tvb, offset, hdr)) <= 0) { |
Event 12:
Skipping " if". (cc = check_term(...)) <= 0 evaluates to false.
hide
|
|
| 626 | | | |
| 627 | | | |
| 628 | | | |
| 629 | | | if (tree) { |
| 630 | | | proto_tree_add_text(hdr, tvb, offset, |
| 631 | | | tvb_length_remaining(tvb, offset), |
| 632 | | | "Undissected Payload: %s", |
| 633 | | | tvb_format_text(tvb, offset, |
| 634 | | | tvb_length_remaining(tvb, offset) |
| 635 | | | ) |
| 636 | | | ); |
| 637 | | | } |
| 638 | | | |
| 639 | | | return -1; |
| 640 | | | |
| 641 | | | } |
| 642 | | | |
| 643 | | | offset += cc; |
| 644 | | | |
| 645 | | | |
| 646 | | | |
| 647 | | | if (beep_frame_data && beep_frame_data->mime_hdr) |
Event 13:
Skipping " if". - beep_frame_data evaluates to true.
- beep_frame_data->mime_hdr evaluates to false.
hide
|
|
| 648 | | | offset += (tvb, offset, beep_frame_data, hdr); |
| 649 | | | |
| 650 | | | |
| 651 | | | |
| 652 | | | if (tvb_length_remaining(tvb, offset) > 0) { |
Event 14:
Taking true branch. tvb_length_remaining(...) > 0 evaluates to true.
hide
|
|
| 653 | | | |
| 654 | | | int pl_size = MIN(size, tvb_length_remaining(tvb, offset));
x /usr/include/glib-2.0/glib/gmacros.h |
| |
201 | #define MIN(a, b) (((a) < (b)) ? (a) : (b)) |
| |
|
Event 15:
size < tvb_length_remaining(...) evaluates to true.
hide
|
|
| 655 | | | |
| 656 | | | |
| 657 | | | |
| 658 | | | |
| 659 | | | |
| 660 | | | |
| 661 | | | |
| 662 | | | |
| 663 | | | if (tree) { |
Event 16:
Skipping " if". tree evaluates to false.
hide
|
|
| 664 | | | proto_tree_add_text(tree, tvb, offset, pl_size, "Payload: %s", tvb_format_text(tvb, offset, pl_size)); |
| 665 | | | |
| 666 | | | } |
| 667 | | | |
| 668 | | | offset += pl_size; |
| 669 | | | |
| 670 | | | if (request_val) { |
Null Test After Dereference
This code tests the nullness of request_val, which has already been dereferenced. - If request_val were null, there would have been a prior null pointer dereference at packet-beep.c:612, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 10. Show: All events | Only primary events |
|
| 671 | | | request_val->size -= pl_size; |
| 672 | | | if (request_val->size < 0) request_val->size = 0; |
| 673 | | | } |
| 674 | | | else { |
| 675 | | | beep_frame_data->pl_size -= pl_size; |
| 676 | | | if (beep_frame_data->pl_size < 0) beep_frame_data->pl_size = 0; |
| 677 | | | } |
| 678 | | | } |
| 679 | | | |
| 680 | | | |
| 681 | | | |
| 682 | | | if (tvb_length_remaining(tvb, offset) > 0) |
| 683 | | | offset += dissect_beep_tree(tvb, offset, pinfo, tree, request_val, beep_frame_data); |
| 684 | | | |
| 685 | | | } else if (tvb_strneql(tvb, offset, "SEQ ", 4) == 0) { |
| 686 | | | |
| 687 | | | if (tree) { |
| 688 | | | hidden_item = proto_tree_add_boolean(tree, hf_beep_seq, tvb, offset, 3, TRUE); |
| 689 | | | proto_tree_add_text(tree, tvb, offset, 3, "Command: SEQ"); |
| 690 | | | } |
| 691 | | | |
| 692 | | | offset += 3; |
| 693 | | | |
| 694 | | | |
| 695 | | | |
| 696 | | | offset += 1; |
| 697 | | | |
| 698 | | | offset += dissect_beep_int(tvb, offset, tree, hf_beep_channel, &channel, seq_chan_hfa); |
| 699 | | | |
| 700 | | | |
| 701 | | | |
| 702 | | | offset += 1; |
| 703 | | | |
| 704 | | | offset += dissect_beep_int(tvb, offset, tree, hf_beep_ackno, &ackno, seq_ackno_hfa); |
| 705 | | | |
| 706 | | | |
| 707 | | | |
| 708 | | | offset += 1; |
| 709 | | | |
| 710 | | | offset += dissect_beep_int(tvb, offset, tree, hf_beep_window, &window, seq_window_hfa); |
| 711 | | | |
| 712 | | | if ((cc = check_term(tvb, offset, tree)) <= 0) { |
| 713 | | | |
| 714 | | | |
| 715 | | | |
| 716 | | | if (tree) { |
| 717 | | | proto_tree_add_text(tree, tvb, offset, |
| 718 | | | tvb_length_remaining(tvb, offset), |
| 719 | | | "Undissected Payload: %s", |
| 720 | | | tvb_format_text(tvb, offset, |
| 721 | | | tvb_length_remaining(tvb, offset) |
| 722 | | | ) |
| 723 | | | ); |
| 724 | | | } |
| 725 | | | |
| 726 | | | return -1; |
| 727 | | | |
| 728 | | | } |
| 729 | | | |
| 730 | | | offset += cc; |
| 731 | | | |
| 732 | | | } else if (tvb_strneql(tvb, offset, "END", 3) == 0) { |
| 733 | | | |
| 734 | | | proto_tree *tr = NULL; |
| 735 | | | |
| 736 | | | if (tree) { |
| 737 | | | ti = proto_tree_add_text(tree, tvb, offset, MIN(5, tvb_length_remaining(tvb, offset)), "Trailer");
x /usr/include/glib-2.0/glib/gmacros.h |
| |
201 | #define MIN(a, b) (((a) < (b)) ? (a) : (b)) |
| |
|
| 738 | | | |
| 739 | | | tr = proto_item_add_subtree(ti, ett_trailer); |
| 740 | | | |
| 741 | | | hidden_item = proto_tree_add_boolean(tr, hf_beep_end, tvb, offset, 3, TRUE); |
| 742 | | | proto_tree_add_text(tr, tvb, offset, 3, "Command: END"); |
| 743 | | | |
| 744 | | | } |
| 745 | | | |
| 746 | | | offset += 3; |
| 747 | | | |
| 748 | | | if ((cc = check_term(tvb, offset, tr)) <= 0) { |
| 749 | | | |
| 750 | | | |
| 751 | | | |
| 752 | | | if (tree) { |
| 753 | | | proto_tree_add_text(tr, tvb, offset, tvb_length_remaining(tvb, offset), |
| 754 | | | "Undissected Payload: %s", |
| 755 | | | tvb_format_text(tvb, offset, |
| 756 | | | tvb_length_remaining(tvb, offset) |
| 757 | | | ) |
| 758 | | | ); |
| 759 | | | } |
| 760 | | | |
| 761 | | | return -1; |
| 762 | | | |
| 763 | | | } |
| 764 | | | |
| 765 | | | offset += cc; |
| 766 | | | |
| 767 | | | } |
| 768 | | | |
| 769 | | | if (tvb_length_remaining(tvb, offset) > 0) { |
| 770 | | | |
| 771 | | | int pl_size = 0; |
| 772 | | | |
| 773 | | | if (request_val) { |
| 774 | | | |
| 775 | | | pl_size = MIN(request_val->size, tvb_length_remaining(tvb, offset));
x /usr/include/glib-2.0/glib/gmacros.h |
| |
201 | #define MIN(a, b) (((a) < (b)) ? (a) : (b)) |
| |
|
| 776 | | | |
| 777 | | | if (pl_size == 0) { |
| 778 | | | |
| 779 | | | pl_size = tvb_length_remaining(tvb, offset); |
| 780 | | | |
| 781 | | | } |
| 782 | | | |
| 783 | | | } else if (beep_frame_data) { |
| 784 | | | pl_size = MIN(beep_frame_data->pl_size, tvb_length_remaining(tvb, offset));
x /usr/include/glib-2.0/glib/gmacros.h |
| |
201 | #define MIN(a, b) (((a) < (b)) ? (a) : (b)) |
| |
|
| 785 | | | } else { |
| 786 | | | pl_size = tvb_length_remaining(tvb, offset); |
| 787 | | | } |
| 788 | | | |
| 789 | | | |
| 790 | | | |
| 791 | | | |
| 792 | | | |
| 793 | | | |
| 794 | | | |
| 795 | | | |
| 796 | | | |
| 797 | | | |
| 798 | | | if (pl_size == 0 && offset == st_offset) |
| 799 | | | pl_size = tvb_length_remaining(tvb, offset); |
| 800 | | | |
| 801 | | | if (pl_size > 0) { |
| 802 | | | |
| 803 | | | if (tree) { |
| 804 | | | proto_tree_add_text(tree, tvb, offset, pl_size, "Payload: %s", |
| 805 | | | tvb_format_text(tvb, offset, pl_size)); |
| 806 | | | } |
| 807 | | | |
| 808 | | | offset += pl_size; |
| 809 | | | |
| 810 | | | if (request_val){ |
| 811 | | | request_val->size -= pl_size; |
| 812 | | | if (request_val->size < 0) request_val->size = 0; |
| 813 | | | } |
| 814 | | | else { |
| 815 | | | beep_frame_data->pl_size -= pl_size; |
| 816 | | | if (beep_frame_data->pl_size < 0) beep_frame_data->pl_size = 0; |
| 817 | | | } |
| 818 | | | } |
| 819 | | | |
| 820 | | | if (tvb_length_remaining(tvb, offset) > 0) { |
| 821 | | | offset += dissect_beep_tree(tvb, offset, pinfo, tree, request_val, beep_frame_data); |
| 822 | | | } |
| 823 | | | } |
| 824 | | | |
| 825 | | | return offset - st_offset; |
| 826 | | | |
| 827 | | | } |
| |