(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-rsvp.c) |
| |
| 3360 | | | dissect_rsvp_label_request (proto_item *ti, proto_tree *rsvp_object_tree, |
| 3361 | | | tvbuff_t *tvb, |
| 3362 | | | int offset, int obj_length, |
| 3363 | | | int class _U_, int type) |
| 3364 | | | { |
| 3365 | | | int offset2 = offset + 4; |
| 3366 | | | |
| 3367 | | | switch(type) { |
| 3368 | | | case 1: { |
| 3369 | | | unsigned short l3pid = tvb_get_ntohs(tvb, offset2+2); |
| 3370 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset+3, 1, |
| 3371 | | | "C-type: 1"); |
| 3372 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset2+2, 2, |
| 3373 | | | "L3PID: %s (0x%04x)", |
| 3374 | | | val_to_str(l3pid, etype_vals, "Unknown"), |
| 3375 | | | l3pid); |
| 3376 | | | proto_item_set_text(ti, "LABEL REQUEST: Basic: L3PID: %s (0x%04x)", |
| 3377 | | | val_to_str(l3pid, etype_vals, "Unknown"), |
| 3378 | | | l3pid); |
| 3379 | | | break; |
| 3380 | | | } |
| 3381 | | | |
| 3382 | | | case 2: { |
| 3383 | | | unsigned short l3pid = tvb_get_ntohs(tvb, offset2+2); |
| 3384 | | | unsigned short min_vpi, min_vci, max_vpi, max_vci; |
| 3385 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset+3, 1, |
| 3386 | | | "C-type: 2 (Label Request with ATM label Range)"); |
| 3387 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset2+2, 2, |
| 3388 | | | "L3PID: %s (0x%04x)", |
| 3389 | | | val_to_str(l3pid, etype_vals, "Unknown"), |
| 3390 | | | l3pid); |
| 3391 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset2+4, 1, |
| 3392 | | | "M: %s Merge in Data Plane", |
| 3393 | | | (tvb_get_guint8(tvb, offset2+4) & 0x80) ? |
| 3394 | | | "1: Can" : "0: Cannot"); |
| 3395 | | | min_vpi = tvb_get_ntohs(tvb, offset2+4) & 0x7f; |
| 3396 | | | min_vci = tvb_get_ntohs(tvb, offset2+6); |
| 3397 | | | max_vpi = tvb_get_ntohs(tvb, offset2+8) & 0x7f; |
| 3398 | | | max_vci = tvb_get_ntohs(tvb, offset2+10); |
| 3399 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset2+4, 2, |
| 3400 | | | "Min VPI: %d", min_vpi); |
| 3401 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset2+6, 2, |
| 3402 | | | "Min VCI: %d", min_vci); |
| 3403 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset2+8, 2, |
| 3404 | | | "Max VPI: %d", max_vpi); |
| 3405 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset2+10, 2, |
| 3406 | | | "Max VCI: %d", max_vci); |
| 3407 | | | proto_item_set_text(ti, "LABEL REQUEST: ATM: L3PID: %s (0x%04x). VPI/VCI: Min: %d/%d, Max: %d/%d. %s Merge. ", |
| 3408 | | | val_to_str(l3pid, etype_vals, "Unknown"), l3pid, |
| 3409 | | | min_vpi, min_vci, max_vpi, max_vci, |
| 3410 | | | (tvb_get_guint8(tvb, offset2+4) & 0x80) ? "Can" : "Cannot"); |
| 3411 | | | break; |
| 3412 | | | } |
| 3413 | | | |
| 3414 | | | case 3: { |
| 3415 | | | guint16 l3pid = tvb_get_ntohs(tvb, offset2+2); |
| 3416 | | | guint32 min_dlci, max_dlci, dlci_len, dlci_len_code; |
| 3417 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset+3, 1, |
| 3418 | | | "C-type: 2 (Label Request with ATM label Range)"); |
| 3419 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset2+2, 2, |
| 3420 | | | "L3PID: %s (0x%04x)", |
| 3421 | | | val_to_str(l3pid, etype_vals, "Unknown"), |
| 3422 | | | l3pid); |
| 3423 | | | dlci_len_code = (tvb_get_ntohs(tvb, offset2+4) & 0x0180) >> 7; |
| 3424 | | | min_dlci = tvb_get_ntohl(tvb, offset2+4) & 0x7fffff; |
| 3425 | | | max_dlci = tvb_get_ntohl(tvb, offset2+8) & 0x7fffff; |
| 3426 | | | switch(dlci_len_code) { |
| 3427 | | | case 0: |
| 3428 | | | |
| 3429 | | | dlci_len = 10; |
| 3430 | | | min_dlci &= 0x3ff; |
| 3431 | | | max_dlci &= 0x3ff; |
| 3432 | | | case 2: |
| 3433 | | | dlci_len = 23; |
| 3434 | | | default: |
| 3435 | | | dlci_len = 0; |
| 3436 | | | min_dlci = 0; |
| 3437 | | | max_dlci = 0; |
| 3438 | | | } |
| 3439 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset2+4, 2, |
| 3440 | | | "DLCI Length: %s (%d)", |
| 3441 | | | dlci_len==10 ? "10 bits" : |
| 3442 | | | dlci_len==23 ? "23 bits" : |
| 3443 | | | "INVALID", dlci_len_code); |
| 3444 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset2+5, 3, |
| 3445 | | | "Min DLCI: %d", min_dlci); |
| 3446 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset2+8, 2, |
| 3447 | | | "Max DLCI: %d", max_dlci); |
| 3448 | | | proto_item_set_text(ti, "LABEL REQUEST: Frame: L3PID: %s (0x%04x). DLCI Len: %s. Min DLCI: %d. Max DLCI: %d", |
| 3449 | | | val_to_str(l3pid, etype_vals, "Unknown"), l3pid, |
| 3450 | | | dlci_len==10 ? "10 bits" : |
| 3451 | | | dlci_len==23 ? "23 bits" : |
| 3452 | | | "INVALID", min_dlci, max_dlci); |
| 3453 | | | break; |
| 3454 | | | } |
| 3455 | | | case 4: { |
| 3456 | | | unsigned short l3pid = tvb_get_ntohs(tvb, offset2+2); |
| 3457 | | | unsigned char lsp_enc = tvb_get_guint8(tvb,offset2); |
| 3458 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset+3, 1, |
| 3459 | | | "C-type: 4 (Generalized Label Request)"); |
| 3460 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset2, 1, |
| 3461 | | | "LSP Encoding Type: %s", |
| 3462 | | | val_to_str(lsp_enc, gmpls_lsp_enc_str, "Unknown (%d)")); |
| 3463 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset2+1, 1, |
| 3464 | | | "Switching Type: %s", |
| 3465 | | | val_to_str(tvb_get_guint8(tvb,offset2+1), |
| 3466 | | | gmpls_switching_type_str, "Unknown (%d)")); |
| 3467 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset2+2, 2, |
| 3468 | | | "G-PID: %s (0x%0x)", |
| 3469 | | | val_to_str(l3pid, gmpls_gpid_str, |
| 3470 | | | val_to_str(l3pid, etype_vals, |
| 3471 | | | "Unknown G-PID(0x%04x)")), |
| 3472 | | | l3pid); |
| 3473 | | | proto_item_set_text(ti, "LABEL REQUEST: Generalized: LSP Encoding=%s, " |
| 3474 | | | "Switching Type=%s, G-PID=%s ", |
| 3475 | | | val_to_str(lsp_enc, gmpls_lsp_enc_str, "Unknown (%d)"), |
| 3476 | | | val_to_str(tvb_get_guint8(tvb,offset2+1), |
| 3477 | | | gmpls_switching_type_str, "Unknown (%d)"), |
| 3478 | | | val_to_str(l3pid, gmpls_gpid_str, |
| 3479 | | | val_to_str(l3pid, etype_vals, |
| 3480 | | | "Unknown (0x%04x)"))); |
Format String
val_to_str() is being called with a format string that is not constant. The format string (third argument) may not match the other arguments to val_to_str(); this could lead to security or stability problems. val_to_str() is usually called with strings that look like format strings in this project. |
|
| 3481 | | | break; |
| 3482 | | | } |
| 3483 | | | |
| 3484 | | | default: { |
| 3485 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset+3, 1, |
| 3486 | | | "C-type: Unknown (%u)", |
| 3487 | | | type); |
| 3488 | | | proto_tree_add_text(rsvp_object_tree, tvb, offset2, obj_length - 4, |
| 3489 | | | "Data (%d bytes)", obj_length - 4); |
| 3490 | | | break; |
| 3491 | | | } |
| 3492 | | | } |
| 3493 | | | } |
| |