(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-imf.c) |
| |
| 469 | | | static void dissect_imf(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) |
| 470 | | | { |
| 471 | | | proto_item *item; |
| 472 | | | proto_tree *unknown_tree, *text_tree; |
| 473 | | | char *content_type_str = NULL; |
| 474 | | | char *parameters = NULL; |
| 475 | | | int hf_id; |
| 476 | | | gint start_offset = 0; |
| 477 | | | gint value_offset = 0; |
| 478 | | | gint unknown_offset = 0; |
| 479 | | | gint end_offset = 0; |
| 480 | | | gint max_length; |
| 481 | | | guint8 *key; |
| 482 | | | gboolean last_field = FALSE; |
| 483 | | | gboolean dissected = FALSE; |
| 484 | | | tvbuff_t *next_tvb; |
| 485 | | | struct imf_field *f_info; |
| 486 | | | |
| 487 | | | if (check_col(pinfo->cinfo, COL_PROTOCOL)) |
Event 1:
Skipping " if". check_col(...) evaluates to false.
hide
|
|
| 488 | | | col_set_str(pinfo->cinfo, COL_PROTOCOL, PSNAME); |
| 489 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
Event 2:
Taking true branch. check_col(...) evaluates to true.
hide
|
|
| 490 | | | col_clear(pinfo->cinfo, COL_INFO); |
| 491 | | | |
| 492 | | | if(tree){ |
Event 3:
Skipping " if". tree evaluates to false.
hide
|
|
| 493 | | | item = proto_tree_add_item(tree, proto_imf, tvb, 0, -1, FALSE); |
| 494 | | | tree = proto_item_add_subtree(item, ett_imf); |
| 495 | | | } |
| 496 | | | |
| 497 | | | max_length = tvb_length(tvb); |
| 498 | | | |
| 499 | | | |
| 500 | | | |
| 501 | | | while(!last_field) { |
Event 4:
Entering loop body. last_field evaluates to false.
hide
|
|
| 502 | | | |
| 503 | | | |
| 504 | | | end_offset = tvb_find_guint8(tvb, start_offset, max_length - start_offset, ':'); |
| 505 | | | |
| 506 | | | if(end_offset == -1) { |
Event 5:
Taking false branch. end_offset == -1 evaluates to false.
hide
|
|
| 507 | | | |
| 508 | | | |
| 509 | | | break; |
| 510 | | | } else { |
| 511 | | | guint8 *p; |
| 512 | | | |
| 513 | | | key = tvb_get_ephemeral_string(tvb, start_offset, end_offset - start_offset); |
| 514 | | | |
| 515 | | | |
| 516 | | | |
| 517 | | | for(p=key; *p; p++) |
| 518 | | | if(isupper(*p)) |
| 519 | | | *p = tolower(*p); |
| 520 | | | |
| 521 | | | |
| 522 | | | f_info = (struct imf_field *)g_hash_table_lookup(imf_field_table, key); |
| 523 | | | |
| 524 | | | if(f_info == (struct imf_field *)NULL) { |
Event 8:
Skipping " if". f_info == (struct imf_field *)(void *)0 evaluates to false.
hide
|
|
| 525 | | | |
| 526 | | | f_info = imf_fields; |
| 527 | | | unknown_offset = start_offset; |
| 528 | | | } |
| 529 | | | |
| 530 | | | hf_id = *(f_info->hf_id); |
| 531 | | | |
| 532 | | | |
| 533 | | | start_offset = end_offset+1; |
| 534 | | | |
| 535 | | | end_offset = imf_find_field_end(tvb, start_offset, max_length, &last_field); |
| 536 | | | |
| 537 | | | if(end_offset != -1) { |
Event 9:
Taking true branch. end_offset != -1 evaluates to true.
hide
|
|
| 538 | | | |
| 539 | | | |
| 540 | | | |
| 541 | | | for(value_offset = start_offset; value_offset < end_offset; value_offset++) |
Event 10:
Leaving loop. value_offset < end_offset evaluates to false.
hide
|
|
| 542 | | | if(!isspace(tvb_get_guint8(tvb, value_offset))) { |
| 543 | | | break; |
| 544 | | | } |
| 545 | | | |
| 546 | | | if(value_offset == end_offset) { |
Event 11:
Taking true branch. value_offset == end_offset evaluates to true.
hide
|
|
| 547 | | | |
| 548 | | | value_offset = start_offset; |
| 549 | | | } |
| 550 | | | |
| 551 | | | if(hf_id == hf_imf_extension_type) { |
Event 12:
Taking false branch. hf_id == hf_imf_extension_type evaluates to false.
hide
|
|
| 552 | | | |
| 553 | | | |
| 554 | | | item = proto_tree_add_item(tree, hf_imf_extension, tvb, unknown_offset, end_offset - unknown_offset - 2, FALSE); |
| 555 | | | |
| 556 | | | proto_item_append_text(item, " (Contact Wireshark developers if you want this supported.)"); |
| 557 | | | |
| 558 | | | unknown_tree = proto_item_add_subtree(item, ett_imf_extension); |
| 559 | | | |
| 560 | | | item = proto_tree_add_item(unknown_tree, hf_imf_extension_type, tvb, unknown_offset, start_offset - 1 - unknown_offset, FALSE); |
| 561 | | | |
| 562 | | | |
| 563 | | | item = proto_tree_add_item(unknown_tree, hf_imf_extension_value, tvb, start_offset, end_offset - start_offset - 2, FALSE); |
| 564 | | | |
| 565 | | | } else |
| 566 | | | |
| 567 | | | |
| 568 | | | item = proto_tree_add_item(tree, hf_id, tvb, value_offset, end_offset - value_offset - 2, FALSE); |
| 569 | | | |
| 570 | | | if(f_info->add_to_col_info && check_col(pinfo->cinfo, COL_INFO)) { |
Event 13:
Skipping " if". f_info->add_to_col_info evaluates to false.
hide
|
|
| 571 | | | |
| 572 | | | col_append_fstr(pinfo->cinfo, COL_INFO, "%s: %s, ", f_info->name, |
| 573 | | | tvb_format_text(tvb, value_offset, end_offset - value_offset - 2)); |
| 574 | | | } |
| 575 | | | |
| 576 | | | if(hf_id == hf_imf_content_type) { |
Event 15:
Taking false branch. hf_id == hf_imf_content_type evaluates to false.
hide
|
|
| 577 | | | |
| 578 | | | |
| 579 | | | dissect_imf_content_type(tvb, start_offset, end_offset - start_offset, item, |
| 580 | | | &content_type_str, ¶meters); |
| 581 | | | |
| 582 | | | } else if(f_info && f_info->subdissector) { |
Null Test After Dereference
This code tests the nullness of f_info, which has already been dereferenced. - If f_info were null, there would have been a prior null pointer dereference at packet-imf.c:570, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 14. Show: All events | Only primary events |
|
| 583 | | | |
| 584 | | | |
| 585 | | | f_info->subdissector(tvb, value_offset, end_offset - value_offset, item); |
| 586 | | | |
| 587 | | | } |
| 588 | | | } |
| 589 | | | } |
| 590 | | | start_offset = end_offset; |
| 591 | | | } |
| 592 | | | |
| 593 | | | |
| 594 | | | |
| 595 | | | |
| 596 | | | |
| 597 | | | |
| 598 | | | if(content_type_str && media_type_dissector_table) { |
| 599 | | | void* pd_save; |
| 600 | | | pd_save = pinfo->private_data; |
| 601 | | | pinfo->private_data = parameters; |
| 602 | | | |
| 603 | | | next_tvb = tvb_new_subset(tvb, end_offset, -1, -1); |
| 604 | | | |
| 605 | | | dissected = dissector_try_string(media_type_dissector_table, content_type_str, next_tvb, pinfo, tree); |
| 606 | | | |
| 607 | | | pinfo->private_data = pd_save; |
| 608 | | | } else { |
| 609 | | | |
| 610 | | | |
| 611 | | | |
| 612 | | | item = proto_tree_add_item(tree, hf_imf_message_text, tvb, start_offset, -1 , FALSE); |
| 613 | | | text_tree = proto_item_add_subtree(item, ett_imf_message_text); |
| 614 | | | |
| 615 | | | start_offset = end_offset; |
| 616 | | | while (tvb_offset_exists(tvb, start_offset)) { |
| 617 | | | |
| 618 | | | |
| 619 | | | |
| 620 | | | |
| 621 | | | tvb_find_line_end(tvb, start_offset, -1, &end_offset, FALSE); |
| 622 | | | |
| 623 | | | |
| 624 | | | |
| 625 | | | |
| 626 | | | proto_tree_add_text(text_tree, tvb, start_offset, end_offset - start_offset, |
| 627 | | | "%s", |
| 628 | | | tvb_format_text(tvb, start_offset, end_offset - start_offset - 2)); |
| 629 | | | |
| 630 | | | |
| 631 | | | |
| 632 | | | |
| 633 | | | start_offset = end_offset; |
| 634 | | | } |
| 635 | | | } |
| 636 | | | } |
| |