(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-wlccp.c) |
| |
| 700 | | | dissect_wlccp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) |
| 701 | | | { |
| 702 | | | |
| 703 | | | proto_item *ti; |
| 704 | | | proto_tree *wlccp_tree, *wlccp_sap_tree, *wlccp_type_tree; |
| 705 | | | |
| 706 | | | guint offset = 0, old_offset; |
| 707 | | | |
| 708 | | | guint8 version=0, sap=0, sap_id=0, sap_version=0; |
| 709 | | | |
| 710 | | | guint16 type; |
| 711 | | | guint8 base_message_type=0, message_sub_type=0; |
| 712 | | | |
| 713 | | | |
| 714 | [+] | | if (check_col(pinfo->cinfo, COL_PROTOCOL)) |
 |
| 715 | | | col_set_str(pinfo->cinfo, COL_PROTOCOL, "WLCCP"); |
| 716 | | | |
| 717 | [+] | | if (check_col(pinfo->cinfo, COL_INFO)) |
 |
| 718 | | | { |
| 719 | [+] | | if(tvb_get_guint8(tvb, 0) == 0xC1) |
 |
| 720 | | | { |
| 721 | | | |
| 722 | | | sap_version = (tvb_get_guint8(tvb,1) & SAP_VERSION_MASK) >> 6; |
| 723 | | | sap_id = tvb_get_guint8(tvb,1) & SAP_VALUE_MASK; |
| 724 | | | base_message_type=(tvb_get_guint8(tvb,6)) & MT_BASE_MSG_TYPE; |
| 725 | | | message_sub_type=(tvb_get_guint8(tvb, 6) & MT_SUBTYPE ) >> 6; |
| 726 | | | |
| 727 | | | |
| 728 | | | switch (sap_id) |
Event 13:
sap_id evaluates to 1.
hide
|
|
| 729 | | | { |
| 730 | | | |
| 731 | | | case WLCCP_SAP_CCM: |
| 732 | | | { |
| 733 | | | |
| 734 | | | col_add_fstr(pinfo->cinfo, COL_INFO, "Message Type: %-27s SubType: %s", |
| 735 | | | val_to_str(base_message_type, wlccp_msg_type_vs_0, "Unknown"), |
| 736 | | | val_to_str(message_sub_type, wlccp_subtype_vs, "Unknown") |
| 737 | | | ); |
| 738 | | | break; |
| 739 | | | |
| 740 | | | } |
| 741 | | | |
| 742 | | | case WLCCP_SAP_SEC: |
| 743 | | | { |
| 744 | | | |
| 745 | | | col_add_fstr(pinfo->cinfo, COL_INFO, "Message Type: %-27s SubType: %s", |
| 746 | [+] | | val_to_str(base_message_type, wlccp_msg_type_vs_1, "Unknown"), |
Event 14:
wlccp_msg_type_vs_1 is passed to val_to_str() as the second argument. - This points to the buffer that will be overrun later.
hide
|
|
 |
| 747 | | | val_to_str(message_sub_type, wlccp_subtype_vs, "Unknown") |
| |