(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-cimd.c) |
| |
| 275 | | | static void dissect_cimd_ud(tvbuff_t *tvb, proto_tree *tree, gint pindex, gint startOffset, gint endOffset) |
| 276 | | | { |
| 277 | | | |
| 278 | | | proto_item *param_item = NULL; |
| 279 | | | proto_tree *param_tree = NULL; |
| 280 | | | |
| 281 | | | gchar* payloadText; |
| 282 | | | gchar* tmpBuffer = (gchar*)ep_alloc(1024); |
| 283 | | | gchar* tmpBuffer1 = (gchar*)ep_alloc(1024); |
| 284 | | | int loop,i,poz, bufPoz = 0, bufPoz1 = 0, size, size1, resch; |
| 285 | | | gint g_offset, g_size; |
| 286 | | | gchar token[4]; |
| 287 | | | gchar ch; |
| 288 | | | const char* mapping[128] = { |
| 289 | | | "_Oa","_L-", "", "_Y-", "_e`", "_e'", "_u`", "_i`", "_o`","_C,", |
| 290 | | | "", "_O/", "_o/", "", "_A*", "_a*","_gd", "_--", "_gf", "_gg", "_gl", |
| 291 | | | "_go", "_gp","_gi", "_gs", "_gt", "_gx", "_XX","_AE","_ae", "_ss","_E'", |
| 292 | | | "","","_qq","", "_ox", "", "","", "", "", "", "", "", "", "", "", |
| 293 | | | "", "", "", "", "", "" , "", "", "", "", "", "", "", "", "", "", |
| 294 | | | "_!!", "", "", "", "", "", "","", "", "", "", "", "", "", "", "", |
| 295 | | | "", "", "", "", "", "", "", "","", "", "", "_A\"", "_O\"", "_N~", |
| 296 | | | "_U\"", "_so", "_??", "", "", "", "", "", "", "", "", "", "", "", |
| 297 | | | "", "", "", "", "", "", "", "","", "", "", "", "", "", "", "_a\"", |
| 298 | | | "_o\"","_n~","_n\"","_a`" |
| 299 | | | }; |
| 300 | | | |
| 301 | | | param_item = proto_tree_add_text(tree, tvb, |
| 302 | | | startOffset + 1, endOffset - (startOffset + 1), |
| 303 | | | "%s", cimd_vals_PC[pindex].strptr |
| 304 | | | ); |
| 305 | | | param_tree = proto_item_add_subtree(param_item, (*vals_hdr_PC[pindex].ett_p)); |
| 306 | | | proto_tree_add_string(param_tree, hf_cimd_pcode_indicator, tvb, |
| 307 | | | startOffset + 1, CIMD_PC_LENGTH, tvb_format_text(tvb, startOffset + 1, CIMD_PC_LENGTH) |
| 308 | | | ); |
| 309 | | | |
| 310 | | | g_offset = startOffset + 1 + CIMD_PC_LENGTH + 1; |
| 311 | | | g_size = endOffset - g_offset; |
| 312 | | | |
| 313 | [+] | | payloadText = tvb_format_text(tvb, g_offset, g_size); |
 |
| 314 | | | size = (int)strlen(payloadText); |
| 315 | | | for (loop = 0; loop < size; loop++) |
Event 4:
Entering loop body. loop < size evaluates to true.
hide
Event 6:
Continuing from loop body. Leaving loop. loop < size evaluates to false.
hide
|
|
| 316 | | | { |
| 317 | | | if (payloadText[loop] == '_') |
Event 5:
Taking false branch. payloadText[loop] == 95 evaluates to false.
hide
|
|
| 318 | | | { |
| 319 | | | if (loop < size - 2) |
| 320 | | | { |
| 321 | | | token[0] = payloadText[loop++]; |
| 322 | | | token[1] = payloadText[loop++]; |
| 323 | | | token[2] = payloadText[loop]; |
| 324 | | | token[3] = '\0'; |
| 325 | | | poz = -1; |
| 326 | | | for (i = 0; i < 128; i++) |
| 327 | | | { |
| 328 341 |  | | [ Lines 328 to 341 omitted. ] |
| 342 | | | tmpBuffer[bufPoz++] = payloadText[loop]; |
| 343 | | | } |
| 344 | | | } |
| 345 | | | else |
| 346 | | | { |
| 347 | | | if(loop < size) tmpBuffer[bufPoz++] = payloadText[loop++]; |
| 348 | | | if(loop < size) tmpBuffer[bufPoz++] = payloadText[loop++]; |
| 349 | | | if(loop < size) tmpBuffer[bufPoz++] = payloadText[loop++]; |
| 350 | | | } |
| 351 | | | } |
| 352 | | | else |
| 353 | | | { |
| 354 | | | tmpBuffer[bufPoz++] = payloadText[loop]; |
| 355 | | | } |
| 356 | | | } |
| 357 | | | tmpBuffer[bufPoz] = '\0'; |
| 358 | | | |
| 359 | | | size1 = (int)strlen(tmpBuffer); |
| 360 | | | for (loop=0; loop<size1;loop++) |
Event 7:
Entering loop body. loop < size1 evaluates to true.
hide
|
|
| 361 | | | { |
| 362 | | | ch = tmpBuffer[loop]; |
| 363 | | | switch ((gint)ch) |
Event 8:
(gint)ch evaluates to 94.
hide
|
|
| 364 | | | { |
| 365 | | | case 0x40: resch = 0x0040; break; |
| 366 | | | case 0x01: resch = 0x00A3; break; |
| 367 | | | case 0x02: resch = 0x0024; break; |
| 368 | | | case 0x03: resch = 0x00A5; break; |
| 369 | | | case 0x04: resch = 0x00E8; break; |
| 370 | | | case 0x05: resch = 0x00E9; break; |
| 371 | | | case 0x06: resch = 0x00F9; break; |
| 372 | | | case 0x07: resch = 0x00EC; break; |
| 373 | | | case 0x08: resch = 0x00F2; break; |
| 374 444 |  | | [ Lines 374 to 444 omitted. ] |
| 445 | | | case 0x54: resch = 0x0054; break; |
| 446 | | | case 0x55: resch = 0x0055; break; |
| 447 | | | case 0x56: resch = 0x0056; break; |
| 448 | | | case 0x57: resch = 0x0057; break; |
| 449 | | | case 0x58: resch = 0x0058; break; |
| 450 | | | case 0x59: resch = 0x0059; break; |
| 451 | | | case 0x5A: resch = 0x005A; break; |
| 452 | | | case 0x5B: resch = 0x00C4; break; |
| 453 | | | case 0x5C: resch = 0x00D6; break; |
| 454 | | | case 0x5D: resch = 0x00D1; break; |
| 455 | | | case 0x5E: resch = 0x00DC; break; |
Event 9:
resch is set to 220. - Determines the value that is cast in the Cast Alters Value warning later.
hide
|
|
| 456 | | | case 0x5F: resch = 0x00A7; break; |
| 457 | | | case 0x60: resch = 0x00BF; break; |
| 458 | | | case 0x61: resch = 0x0061; break; |
| 459 | | | case 0x62: resch = 0x0062; break; |
| 460 | | | case 0x63: resch = 0x0063; break; |
| 461 | | | case 0x64: resch = 0x0064; break; |
| 462 | | | case 0x65: resch = 0x0065; break; |
| 463 | | | case 0x66: resch = 0x0066; break; |
| 464 | | | case 0x67: resch = 0x0067; break; |
| 465 | | | case 0x68: resch = 0x0068; break; |
| 466 479 |  | | [ Lines 466 to 479 omitted. ] |
| 480 | | | case 0x77: resch = 0x0077; break; |
| 481 | | | case 0x78: resch = 0x0078; break; |
| 482 | | | case 0x79: resch = 0x0079; break; |
| 483 | | | case 0x7A: resch = 0x007A; break; |
| 484 | | | case 0x7B: resch = 0x00E4; break; |
| 485 | | | case 0x7C: resch = 0x00F6; break; |
| 486 | | | case 0x7D: resch = 0x00F1; break; |
| 487 | | | case 0x7F: resch = 0x00E0; break; |
| 488 | | | default:resch = ch;break; |
| 489 | | | } |
| 490 | | | tmpBuffer1[bufPoz1++] = (gchar)resch; |
Cast Alters Value
resch is cast from int to char. - resch evaluates to 220.
- Values 128 or higher cannot be stored as char. Casting them to char can cause data loss or sign change.
The issue can occur if the highlighted code executes. See related event 9. Show: All events | Only primary events |
|
| |