(/home/sate/Testcases/c/cve/wireshark-1.2.0/gtk/mac_lte_stat_dlg.c) |
| |
| 265 | | | mac_lte_stat_packet(void *phs, packet_info *pinfo, epan_dissect_t *edt _U_, |
| 266 | | | const void *phi) |
| 267 | | | { |
| 268 | | | int n; |
| 269 | | | |
| 270 | | | |
| 271 | | | mac_lte_stat_t *hs = (mac_lte_stat_t *)phs; |
| 272 | | | mac_lte_ep_t *tmp = NULL, *te = NULL; |
| 273 | | | |
| 274 | | | |
| 275 | | | struct mac_lte_tap_info *si = (struct mac_lte_tap_info *)phi; |
| 276 | | | |
| 277 | | | if (!hs) { |
Event 1:
Skipping " if". hs evaluates to true.
hide
|
|
| 278 | | | return (0); |
| 279 | | | } |
| 280 | | | |
| 281 | | | |
| 282 | | | switch (si->rntiType) { |
Event 2:
si->rntiType evaluates to 3.
hide
|
|
| 283 | | | case P_RNTI: |
| 284 | | | common_stats.pch_frames++; |
| 285 | | | common_stats.pch_bytes += si->single_number_of_bytes; |
| 286 | | | return 1; |
| 287 | | | case SI_RNTI: |
| 288 | | | case NO_RNTI: |
| 289 | | | common_stats.bch_frames++; |
| 290 | | | common_stats.bch_bytes += si->single_number_of_bytes; |
| 291 | | | return 1; |
| 292 | | | case RA_RNTI: |
| 293 | | | common_stats.rar_frames++; |
| 294 | | | common_stats.rar_entries += si->number_of_rars; |
| 295 | | | return 1; |
| 296 | | | case C_RNTI: |
| 297 | | | |
| 298 | | | break; |
| 299 | | | |
| 300 | | | default: |
| 301 | | | return 0; |
| 302 | | | } |
| 303 | | | |
| 304 | | | |
| 305 | | | if (!hs->ep_list) { |
Event 3:
Taking false branch. hs->ep_list evaluates to true.
hide
|
|
| 306 | | | |
| 307 | | | hs->ep_list = alloc_mac_lte_ep(si, pinfo); |
| 308 | | | |
| 309 | | | te = hs->ep_list; |
| 310 | | | } else { |
| 311 | | | |
| 312 | | | for (tmp = hs->ep_list;(tmp != NULL); tmp = tmp->next) { |
Event 4:
Entering loop body. tmp != (void *)0 evaluates to true.
hide
|
|
| 313 | | | if (tmp->stats.rnti == si->rnti) { |
Event 5:
Taking true branch. tmp->stats.rnti == si->rnti evaluates to true.
hide
|
|
| 314 | | | te = tmp; |
| 315 | | | break; |
| 316 | | | } |
| 317 | | | } |
| 318 | | | |
| 319 | | | |
| 320 | | | if (te == NULL) { |
Null Test After Dereference
This code tests the nullness of te, which has already been dereferenced. - If te were null, there would have been a prior null pointer dereference at mac_lte_stat_dlg.c:313, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 7. Show: All events | Only primary events |
|
| 321 | | | if ((te = alloc_mac_lte_ep(si, pinfo))) { |
| 322 | | | |
| 323 | | | te->next = hs->ep_list; |
| 324 | | | hs->ep_list = te; |
| 325 | | | } |
| 326 | | | } |
| 327 | | | } |
| 328 | | | |
| 329 | | | |
| 330 | | | if (!te) { |
| 331 | | | return 0; |
| 332 | | | } |
| 333 | | | |
| 334 | | | |
| 335 | | | te->stats.rnti = si->rnti; |
| 336 | | | te->stats.is_predefined_data = si->isPredefinedData; |
| 337 | | | if (si->crcStatusValid && !si->crcStatus) { |
| 338 | | | if (si->direction == DIRECTION_UPLINK) { |
| 339 | | | te->stats.UL_CRC_errors++; |
| 340 | | | return 1; |
| 341 | | | } |
| 342 | | | else { |
| 343 | | | te->stats.DL_CRC_errors++; |
| 344 | | | return 1; |
| 345 | | | } |
| 346 | | | } |
| 347 | | | |
| 348 | | | |
| 349 | | | if (si->direction == DIRECTION_UPLINK) { |
| 350 | | | if (si->reTxCount >= 1) { |
| 351 | | | te->stats.UL_retx_frames++; |
| 352 | | | return 1; |
| 353 | | | } |
| 354 | | | te->stats.UL_frames++; |
| 355 | | | |
| 356 | | | if (si->isPredefinedData) { |
| 357 | | | te->stats.UL_total_bytes += si->single_number_of_bytes; |
| 358 | | | } |
| 359 | | | else { |
| 360 | | | for (n=0; n < 11; n++) { |
| 361 | | | if (si->bytes_for_lcid[n]) { |
| 362 | | | te->stats.UL_sdus_for_lcid[n] += si->sdus_for_lcid[n]; |
| 363 | | | } |
| 364 | | | te->stats.UL_bytes_for_lcid[n] += si->bytes_for_lcid[n]; |
| 365 | | | te->stats.UL_total_bytes += si->bytes_for_lcid[n]; |
| 366 | | | } |
| 367 | | | } |
| 368 | | | } |
| 369 | | | |
| 370 | | | |
| 371 | | | else { |
| 372 | | | if (si->reTxCount >= 1) { |
| 373 | | | te->stats.DL_retx_frames++; |
| 374 | | | return 1; |
| 375 | | | } |
| 376 | | | |
| 377 | | | te->stats.DL_frames++; |
| 378 | | | |
| 379 | | | if (si->isPredefinedData) { |
| 380 | | | te->stats.DL_total_bytes += si->single_number_of_bytes; |
| 381 | | | } |
| 382 | | | else { |
| 383 | | | for (n=0; n < 11; n++) { |
| 384 | | | if (si->bytes_for_lcid[n]) { |
| 385 | | | te->stats.DL_sdus_for_lcid[n] += si->sdus_for_lcid[n]; |
| 386 | | | } |
| 387 | | | te->stats.DL_bytes_for_lcid[n] += si->bytes_for_lcid[n]; |
| 388 | | | te->stats.DL_total_bytes += si->bytes_for_lcid[n]; |
| 389 | | | } |
| 390 | | | } |
| 391 | | | } |
| 392 | | | |
| 393 | | | return 1; |
| 394 | | | } |
| |