(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-wbxml.c) |
| |
| 6695 | | | dissect_wbxml_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, |
| 6696 | | | const wbxml_decoding *override_content_map) |
| 6697 | | | { |
| 6698 | | | |
| 6699 | | | proto_item *ti; |
| 6700 | | | proto_tree *wbxml_tree; |
| 6701 | | | proto_tree *wbxml_str_tbl_tree; |
| 6702 | | | proto_tree *wbxml_content_tree; |
| 6703 | | | guint8 version; |
| 6704 | | | guint offset = 0; |
| 6705 | | | guint32 len; |
| 6706 | | | guint32 charset = 0; |
| 6707 | | | guint32 charset_len = 0; |
| 6708 | | | guint32 publicid; |
| 6709 | | | guint32 publicid_index = 0; |
| 6710 | | | guint32 publicid_len; |
| 6711 | | | guint32 str_tbl; |
| 6712 | | | guint32 str_tbl_len; |
| 6713 | | | guint32 str_tbl_len_len = 0; |
| 6714 | | | guint8 level = 0; |
| 6715 | | | const wbxml_decoding *content_map = NULL; |
| 6716 | | | gchar *summary = NULL; |
| 6717 | | | guint8 codepage_stag = 0; |
| 6718 | | | guint8 codepage_attr = 0; |
| 6719 | | | |
| 6720 | | | DebugLog(("dissect_wbxml: Dissecting packet %u\n", pinfo->fd->num)); |
| 6721 | | | |
| 6722 | | | |
| 6723 | | | |
| 6724 | | | |
| 6725 | | | |
| 6726 | | | |
| 6727 | | | |
| 6728 | | | switch ( version = tvb_get_guint8 (tvb, 0) ) { |
Event 1:
version = tvb_get_guint8(...) evaluates to 0.
hide
|
|
| 6729 | | | case 0x00: |
| 6730 | | | break; |
| 6731 | | | |
| 6732 | | | case 0x01: |
| 6733 | | | case 0x02: |
| 6734 | | | case 0x03: |
| 6735 | | | break; |
| 6736 | | | |
| 6737 | | | default: |
| 6738 | | | |
| 6739 | | | |
| 6740 | | | |
| 6741 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
| 6742 | | | col_append_fstr(pinfo->cinfo, COL_INFO, " (Unknown WBXML version 0x%02x)", version); |
| 6743 | | | ti = proto_tree_add_item (tree, proto_wbxml, tvb, 0, -1, FALSE); |
| 6744 | | | proto_item_append_text(ti, ", Unknown version 0x%02x", version); |
| 6745 | | | return; |
| 6746 | | | } |
| 6747 | | | |
| 6748 | | | |
| 6749 | | | |
| 6750 | | | |
| 6751 | | | |
| 6752 | | | |
| 6753 | | | |
| 6754 | | | publicid = tvb_get_guintvar(tvb, 1, &publicid_len); |
| 6755 | | | if (! publicid) { |
Event 2:
Skipping " if". publicid evaluates to true.
hide
|
|
| 6756 | | | |
| 6757 | | | publicid_index = tvb_get_guintvar (tvb, 1+publicid_len, &len); |
| 6758 | | | publicid_len += len; |
| 6759 | | | } |
| 6760 | | | offset = 1 + publicid_len; |
| 6761 | | | |
| 6762 | | | |
| 6763 | | | switch ( version ) { |
Event 3:
version evaluates to 0.
hide
|
|
| 6764 | | | case 0x00: |
| 6765 | | | |
| 6766 | | | break; |
| 6767 | | | |
| 6768 | | | case 0x01: |
| 6769 | | | case 0x02: |
| 6770 | | | case 0x03: |
| 6771 | | | |
| 6772 | | | charset = tvb_get_guintvar (tvb, offset, &charset_len); |
| 6773 | | | offset += charset_len; |
| 6774 | | | break; |
| 6775 | | | |
| 6776 | | | default: |
| 6777 | | | DISSECTOR_ASSERT_NOT_REACHED();
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
131 | #define DISSECTOR_ASSERT_NOT_REACHED() \ |
132 | (REPORT_DISSECTOR_BUG( \ |
133 | ep_strdup_printf("%s:%u: failed assertion \"DISSECTOR_ASSERT_NOT_REACHED\"", \ |
134 | __FILE__, __LINE__))) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
106 | #define REPORT_DISSECTOR_BUG(message) \ |
107 | ((getenv("WIRESHARK_ABORT_ON_DISSECTOR_BUG") != NULL) ? \ |
108 | abort() : \ |
109 | THROW_MESSAGE(DissectorError, message)) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/exceptions.h |
| |
226 | #define THROW_MESSAGE(x, y) \ |
227 | except_throw(XCEPT_GROUP_WIRESHARK, (x), (y)) |
| |
|
| 6778 | | | break; |
| 6779 | | | } |
| 6780 | | | |
| 6781 | | | |
| 6782 | | | str_tbl_len = tvb_get_guintvar (tvb, offset, &str_tbl_len_len); |
| 6783 | | | str_tbl = offset + str_tbl_len_len; |
| 6784 | | | |
| 6785 | | | |
| 6786 | | | if ( publicid ) { |
Event 4:
Taking true branch. publicid evaluates to true.
hide
|
|
| 6787 | | | summary = g_strdup_printf("%s, Public ID: \"%s\"", |
| 6788 | | | val_to_str (version, vals_wbxml_versions, "(unknown 0x%x)"), |
| 6789 | | | val_to_str (publicid, vals_wbxml_public_ids, "(unknown 0x%x)")); |
| 6790 | | | } else { |
| 6791 | | | |
| 6792 | | | len = tvb_strsize (tvb, str_tbl + publicid_index); |
| 6793 | | | summary = g_strdup_printf("%s, Public ID: \"%s\"", |
| 6794 | | | val_to_str (version, vals_wbxml_versions, "(unknown 0x%x)"), |
| 6795 | | | tvb_format_text (tvb, str_tbl + publicid_index, len - 1)); |
| 6796 | | | } |
| 6797 | | | |
| 6798 | | | |
| 6799 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
Event 6:
Skipping " if". check_col(...) evaluates to false.
hide
|
|
| 6800 | | | col_append_fstr(pinfo->cinfo, COL_INFO, " (WBXML %s)", summary); |
| 6801 | | | |
| 6802 | | | |
| 6803 | | | ti = proto_tree_add_item (tree, proto_wbxml, tvb, 0, -1, FALSE); |
| 6804 | | | proto_item_append_text(ti, ", Version: %s", summary); |
| 6805 | | | g_free(summary); |
| 6806 | | | |
| 6807 | | | |
| 6808 | | | |
| 6809 | | | if ( tree ) { |
Event 8:
Taking true branch. tree evaluates to true.
hide
|
|
| 6810 | | | wbxml_tree = proto_item_add_subtree(ti, ett_wbxml); |
| 6811 | | | |
| 6812 | | | |
| 6813 | | | proto_tree_add_uint (wbxml_tree, hf_wbxml_version, |
| 6814 | | | tvb, 0, 1, version); |
| 6815 | | | |
| 6816 | | | |
| 6817 | | | if (publicid) { |
Event 9:
Taking true branch. publicid evaluates to true.
hide
|
|
| 6818 | | | proto_tree_add_uint(wbxml_tree, hf_wbxml_public_id_known, |
| 6819 | | | tvb, 1, publicid_len, publicid); |
| 6820 | | | } else { |
| 6821 | | | proto_tree_add_item (wbxml_tree, hf_wbxml_public_id_literal, |
| 6822 | | | tvb, 1, publicid_len, FALSE); |
| 6823 | | | } |
| 6824 | | | offset = 1 + publicid_len; |
| 6825 | | | |
| 6826 | | | if ( version ) { |
Event 10:
Skipping " if". version evaluates to false.
hide
|
|
| 6827 | | | proto_tree_add_uint (wbxml_tree, hf_wbxml_charset, |
| 6828 | | | tvb, 1 + publicid_len, charset_len, charset); |
| 6829 | | | offset += charset_len; |
| 6830 | | | } |
| 6831 | | | |
| 6832 | | | str_tbl_len = tvb_get_guintvar (tvb, offset, &len); |
| 6833 | | | str_tbl = offset + len; |
| 6834 | | | |
| 6835 | | | |
| 6836 | | | ti = proto_tree_add_text(wbxml_tree, |
| 6837 | | | tvb, offset, len + str_tbl_len, "String table: %u bytes", |
| 6838 | | | str_tbl_len); |
| 6839 | | | |
| 6840 | | | if (wbxml_tree && str_tbl_len) { |
Event 11:
Skipping " if". - wbxml_tree evaluates to true.
- str_tbl_len evaluates to false.
hide
|
|
| 6841 | | | wbxml_str_tbl_tree = proto_item_add_subtree (ti, |
| 6842 | | | ett_wbxml_str_tbl); |
| 6843 | | | show_wbxml_string_table (wbxml_str_tbl_tree, tvb, |
| 6844 | | | str_tbl, str_tbl_len); |
| 6845 | | | } |
| 6846 | | | |
| 6847 | | | |
| 6848 | | | offset += len + str_tbl_len; |
| 6849 | | | |
| 6850 | | | |
| 6851 | | | if (disable_wbxml_token_parsing) { |
Event 12:
Skipping " if". disable_wbxml_token_parsing evaluates to false.
hide
|
|
| 6852 | | | ti = proto_tree_add_text (wbxml_tree, tvb, offset, -1, |
| 6853 | | | "Data representation not shown " |
| 6854 | | | "(edit WBXML preferences to show)"); |
| 6855 | | | return; |
| 6856 | | | } |
| 6857 | | | ti = proto_tree_add_text (wbxml_tree, tvb, offset, -1, |
| 6858 | | | "Data representation"); |
| 6859 | | | wbxml_content_tree = proto_item_add_subtree (ti, ett_wbxml_content); |
| 6860 | | | |
| 6861 | | | |
| 6862 | | | |
| 6863 | | | |
| 6864 | | | |
| 6865 | | | if (wbxml_tree) { |
Event 13:
Taking true branch. wbxml_tree evaluates to true.
hide
|
|
| 6866 | | | if (override_content_map != NULL) { |
Event 14:
Taking true branch. override_content_map != (void *)0 evaluates to true.
hide
|
|
| 6867 | | | content_map = override_content_map; |
| 6868 | | | proto_item_append_text(ti, |
| 6869 | | | " is based on: %s", |
| 6870 | | | content_map->name); |
| 6871 | | | } else { |
| 6872 | | | |
| 6873 | | | content_map = get_wbxml_decoding_from_public_id (publicid); |
| 6874 | | | if (! content_map) { |
| 6875 | | | content_map = get_wbxml_decoding_from_content_type( |
| 6876 | | | pinfo->match_string, tvb, offset); |
| 6877 | | | if (! content_map) { |
| 6878 | | | proto_tree_add_text (wbxml_content_tree, |
| 6879 | | | tvb, offset, -1, |
| 6880 | | | "[Rendering of this content type" |
| 6881 | | | " not (yet) supported]"); |
| 6882 | | | } else { |
| 6883 | | | proto_item_append_text(ti, |
| 6884 | | | " is based on Content-Type: %s " |
| 6885 | | | "(chosen decoding: %s)", |
| 6886 | | | pinfo->match_string, content_map->name); |
| 6887 | | | } |
| 6888 | | | } |
| 6889 | | | } |
| 6890 | | | if (content_map && skip_wbxml_token_mapping) { |
Event 16:
Skipping " if". - content_map evaluates to true.
- skip_wbxml_token_mapping evaluates to false.
hide
|
|
| 6891 | | | proto_tree_add_text (wbxml_content_tree, |
| 6892 | | | tvb, offset, -1, |
| 6893 | | | "[Rendering of this content type" |
| 6894 | | | " has been disabled " |
| 6895 | | | "(edit WBXML preferences to enable)]"); |
| 6896 | | | content_map = NULL; |
| 6897 | | | } |
| 6898 | | | proto_tree_add_text (wbxml_content_tree, tvb, |
| 6899 | | | offset, -1, |
| 6900 | | | "Level | State | Codepage " |
| 6901 | | | "| WBXML Token Description " |
| 6902 | | | "| Rendering"); |
| 6903 | | | if (content_map) { |
Null Test After Dereference
This code tests the nullness of content_map, which has already been dereferenced. - If content_map were null, there would have been a prior null pointer dereference at packet-wbxml.c:6870, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 15. Show: All events | Only primary events |
|
| 6904 | | | len = parse_wbxml_tag_defined (wbxml_content_tree, |
| 6905 | | | tvb, offset, str_tbl, &level, &codepage_stag, |
| 6906 | | | &codepage_attr, content_map); |
| 6907 | | | } else { |
| 6908 | | | |
| 6909 | | | len = parse_wbxml_tag (wbxml_content_tree, tvb, offset, |
| 6910 | | | str_tbl, &level, &codepage_stag, &codepage_attr); |
| 6911 | | | } |
| 6912 | | | } |
| 6913 | | | return; |
| 6914 | | | } |
| 6915 | | | } |
| |