(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dcom-dispatch.c) |
| |
| 268 | | | dissect_IDispatch_Invoke_rqst(tvbuff_t *tvb, int offset, |
| 269 | | | packet_info *pinfo, proto_tree *tree, guint8 *drep) |
| 270 | | | { |
| 271 | | | guint32 u32DispIdMember; |
| 272 | | | e_uuid_t riid; |
| 273 | | | guint32 u32Lcid; |
| 274 | | | guint32 u32Flags; |
| 275 | | | guint32 u32Args; |
| 276 | | | guint32 u32NamedArgs; |
| 277 | | | guint32 u32Pointer; |
| 278 | | | guint32 u32Pointer2; |
| 279 | | | guint32 u32ArraySize; |
| 280 | | | guint32 u32VariableOffset; |
| 281 | | | guint32 u32VarRef; |
| 282 | | | guint32 u32VarRefIdx; |
| 283 | | | guint32 u32TmpOffset; |
| 284 | | | guint32 u32SubStart; |
| 285 | | | |
| 286 | | | proto_item *feature_item; |
| 287 | | | proto_tree *feature_tree; |
| 288 | | | proto_item *dispparams_item; |
| 289 | | | proto_tree *dispparams_tree; |
| 290 | | | |
| 291 | | | |
| 292 | | | offset = dissect_dcom_this(tvb, offset, pinfo, tree, drep); |
| 293 | | | |
| 294 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, drep, |
| 295 | | | hf_dispatch_id, &u32DispIdMember); |
| 296 | [+] | | if (check_col(pinfo->cinfo, COL_INFO)) { |
 |
| 297 | | | col_append_fstr(pinfo->cinfo, COL_INFO, " ID=0x%x", u32DispIdMember); |
| 298 | | | } |
| 299 | | | |
| 300 | | | offset = dissect_dcom_UUID(tvb, offset, pinfo, tree, drep, |
| 301 | | | hf_dispatch_riid, &riid); |
| 302 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, drep, |
| 303 | | | hf_dispatch_lcid, &u32Lcid); |
| 304 | | | |
| 305 | | | |
| 306 | | | u32TmpOffset = dissect_dcom_DWORD(tvb, offset, pinfo, NULL, drep, |
| 307 | | | hf_dispatch_flags, &u32Flags); |
| 308 | | | feature_item = proto_tree_add_uint (tree, hf_dispatch_flags, tvb, offset, 4, u32Flags); |
| 309 | [+] | | feature_tree = proto_item_add_subtree (feature_item, ett_dispatch_flags); |
 |
| 310 | | | if (feature_tree) { |
Event 4:
Skipping " if". feature_tree evaluates to false.
hide
|
|
| 311 | | | proto_tree_add_boolean (feature_tree, hf_dispatch_flags_propputref, tvb, offset, 4, u32Flags); |
| 312 | | | proto_tree_add_boolean (feature_tree, hf_dispatch_flags_propput, tvb, offset, 4, u32Flags); |
| 313 | | | proto_tree_add_boolean (feature_tree, hf_dispatch_flags_propget, tvb, offset, 4, u32Flags); |
| 314 | | | proto_tree_add_boolean (feature_tree, hf_dispatch_flags_method, tvb, offset, 4, u32Flags); |
| 315 | | | } |
| 316 | | | |
| 317 | | | if (u32Flags & DISPATCH_FLAGS_METHOD) { |
Event 5:
Skipping " if". u32Flags & 1 evaluates to false.
hide
|
|
| 318 | | | proto_item_append_text(feature_item, ", Method"); |
| 319 | | | if (check_col(pinfo->cinfo, COL_INFO)) { |
| 320 | | | col_append_str(pinfo->cinfo, COL_INFO, " Method"); |
| 321 | | | } |
| 322 | | | } |
| 323 | | | if (u32Flags & DISPATCH_FLAGS_PROPGET) { |
Event 6:
Skipping " if". u32Flags & 2 evaluates to false.
hide
|
|
| 324 | | | proto_item_append_text(feature_item, ", PropertyGet"); |
| 325 | | | if (check_col(pinfo->cinfo, COL_INFO)) { |
| 326 | | | col_append_str(pinfo->cinfo, COL_INFO, " PropertyGet"); |
| 327 | | | } |
| 328 | | | } |
| 329 | | | if (u32Flags & DISPATCH_FLAGS_PROPPUT) { |
Event 7:
Skipping " if". u32Flags & 4 evaluates to false.
hide
|
|
| 330 | | | proto_item_append_text(feature_item, ", PropertyPut"); |
| 331 | | | if (check_col(pinfo->cinfo, COL_INFO)) { |
| 332 | | | col_append_str(pinfo->cinfo, COL_INFO, " PropertyPut"); |
| 333 | | | } |
| 334 | | | } |
| 335 | | | if (u32Flags & DISPATCH_FLAGS_PROPPUTREF) { |
Event 8:
Skipping " if". u32Flags & 8 evaluates to false.
hide
|
|
| 336 | | | proto_item_append_text(feature_item, ", PropertyPutRef"); |
| 337 | | | if (check_col(pinfo->cinfo, COL_INFO)) { |
| 338 | | | col_append_str(pinfo->cinfo, COL_INFO, " PropertyPutRef"); |
| 339 | | | } |
| 340 | | | } |
| 341 | | | |
| 342 | | | offset = u32TmpOffset; |
| 343 | | | |
| 344 | | | dispparams_item = proto_tree_add_item(tree, hf_dispatch_dispparams, tvb, offset, 0, FALSE); |
| 345 | | | dispparams_tree = proto_item_add_subtree (dispparams_item, ett_dispatch_params); |
| 346 | | | u32SubStart = offset; |
| 347 | | | |
| 348 | | | |
| 349 | | | |
| 350 | | | offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, dispparams_tree, drep, |
| 351 | | | &u32Pointer); |
| 352 | | | |
| 353 | | | |
| 354 | | | offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, dispparams_tree, drep, |
| 355 | | | &u32Pointer2); |
| 356 | | | |
| 357 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, dispparams_tree, drep, |
| 358 | | | hf_dispatch_args, &u32Args); |
| 359 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, dispparams_tree, drep, |
| 360 | | | hf_dispatch_named_args, &u32NamedArgs); |
| 361 | | | |
| 362 | | | if (u32Pointer) { |
Event 9:
Taking true branch. u32Pointer evaluates to true.
hide
|
|
| 363 | | | offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, dispparams_tree, drep, |
| 364 | [+] | | &u32ArraySize); |
Event 10:
dissect_dcom_dcerpc_array_size() does not initialize u32ArraySize. - This may be because of a failure case or other special case for dissect_dcom_dcerpc_array_size().
hide
|
|
 |
| 365 | | | u32VariableOffset = offset + u32ArraySize * 4; |
Uninitialized Variable
u32ArraySize was not initialized. The issue can occur if the highlighted code executes. See related events 10 and 12. Show: All events | Only primary events |
|
| |