(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-gsm_bssmap_le.c) |
| |
| 856 | | | dissect_bssmap_le(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) |
| 857 | | | { |
| 858 | | | static gsm_a_tap_rec_t tap_rec[4]; |
| 859 | | | static gsm_a_tap_rec_t *tap_p; |
| 860 | | | static guint tap_current=0; |
| 861 | | | guint8 oct; |
| 862 | | | guint32 offset, saved_offset; |
| 863 | | | guint32 len; |
| 864 | | | gint idx; |
| 865 | | | proto_item *bssmap_le_item = NULL; |
| 866 | | | proto_tree *bssmap_le_tree = NULL; |
| 867 | | | const gchar *str; |
| 868 | | | sccp_msg_info_t* sccp_msg; |
| 869 | | | |
| 870 | | | sccp_msg = pinfo->sccp_info; |
| 871 | | | |
| 872 | | | if (!(sccp_msg && sccp_msg->data.co.assoc)) { |
Event 1:
Skipping " if". - sccp_msg evaluates to true.
- sccp_msg->data.co.assoc evaluates to true.
hide
|
|
| 873 | | | sccp_msg = NULL; |
| 874 | | | } |
| 875 | | | |
| 876 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
Event 3:
Skipping " if". check_col(...) evaluates to false.
hide
|
|
| 877 | | | { |
| 878 | | | col_append_str(pinfo->cinfo, COL_INFO, "(BSSMAP LE) "); |
| 879 | | | } |
| 880 | | | |
| 881 | | | |
| 882 | | | |
| 883 | | | |
| 884 | | | tap_current++; |
| 885 | | | if (tap_current >= 4) |
Event 4:
Skipping " if". tap_current >= 4 evaluates to false.
hide
|
|
| 886 | | | { |
| 887 | | | tap_current = 0; |
| 888 | | | } |
| 889 | | | tap_p = &tap_rec[tap_current]; |
| 890 | | | |
| 891 | | | |
| 892 | | | offset = 0; |
| 893 | | | saved_offset = offset; |
| 894 | | | |
| 895 | | | g_pinfo = pinfo; |
| 896 | | | g_tree = tree; |
| 897 | | | |
| 898 | | | len = tvb_length(tvb); |
| 899 | | | |
| 900 | | | |
| 901 | | | |
| 902 | | | |
| 903 | | | oct = tvb_get_guint8(tvb, offset++); |
| 904 | | | |
| 905 | | | str = match_strval_idx((guint32) oct, gsm_bssmap_le_msg_strings, &idx); |
| 906 | | | |
| 907 | | | if (sccp_msg && !sccp_msg->data.co.label) { |
Null Test After Dereference
This code tests the nullness of sccp_msg, which has already been dereferenced. - If sccp_msg were null, there would have been a prior null pointer dereference at packet-gsm_bssmap_le.c:872, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 2. Show: All events | Only primary events |
|
| 908 | | | sccp_msg->data.co.label = se_strdup(val_to_str((guint32) oct, gsm_bssmap_le_msg_strings, "BSSMAP LE(0x%02x)")); |
| 909 | | | } |
| 910 | | | |
| 911 | | | |
| 912 | | | |
| 913 | | | |
| 914 | | | if (str == NULL) |
| 915 | | | { |
| 916 | | | bssmap_le_item = |
| 917 | | | proto_tree_add_protocol_format(tree, proto_bssmap_le, tvb, 0, len, |
| 918 | | | "Lb - I/F BSSMAP LE - Unknown BSSMAP Message Type (0x%02x)", |
| 919 | | | oct); |
| 920 | | | |
| 921 | | | bssmap_le_tree = proto_item_add_subtree(bssmap_le_item, ett_bssmap_le_msg); |
| 922 | | | } |
| 923 | | | else |
| 924 | | | { |
| 925 | | | bssmap_le_item = |
| 926 | | | proto_tree_add_protocol_format(tree, proto_bssmap_le, tvb, 0, -1, |
| 927 | | | "Lb - I/F BSSMAP LE - %s", |
| 928 | | | str); |
| 929 | | | |
| 930 | | | bssmap_le_tree = proto_item_add_subtree(bssmap_le_item, ett_gsm_bssmap_le_msg[idx]); |
| 931 | | | |
| 932 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
| 933 | | | { |
| 934 | | | col_append_fstr(pinfo->cinfo, COL_INFO, "%s ", str); |
| 935 | | | } |
| 936 | | | |
| 937 | | | |
| 938 | | | |
| 939 | | | |
| 940 | | | proto_tree_add_uint_format(bssmap_le_tree, hf_gsm_bssmap_le_msg_type, |
| 941 | | | tvb, saved_offset, 1, oct, "Message Type %s",str); |
| 942 | | | } |
| 943 | | | |
| 944 | | | tap_p->pdu_type = BSSAP_PDU_TYPE_BSSMAP; |
| 945 | | | tap_p->message_type = oct; |
| 946 | | | |
| 947 | | | tap_queue_packet(gsm_a_tap, pinfo, tap_p); |
| 948 | | | |
| 949 | | | if (str == NULL) return; |
| 950 | | | |
| 951 | | | if ((len - offset) <= 0) return; |
| 952 | | | |
| 953 | | | |
| 954 | | | |
| 955 | | | |
| 956 | | | if (bssmap_le_msg_fcn[idx] == NULL) |
| 957 | | | { |
| 958 | | | proto_tree_add_text(bssmap_le_tree, |
| 959 | | | tvb, offset, len - offset, |
| 960 | | | "Message Elements"); |
| 961 | | | } |
| 962 | | | else |
| 963 | | | { |
| 964 | | | (*bssmap_le_msg_fcn[idx])(tvb, bssmap_le_tree, offset, len - offset); |
| 965 | | | } |
| 966 | | | } |
| |