(/home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/mate/mate_runtime.c) |
| |
| 469 | | | static void analize_pdu(mate_pdu* pdu) { |
| 470 | | | |
| 471 | | | |
| 472 | | | |
| 473 | | | |
| 474 | | | mate_cfg_gop* cfg = NULL; |
| 475 | | | mate_gop* gop = NULL; |
| 476 | | | gchar* gop_key; |
| 477 | | | gchar* orig_gop_key = NULL; |
| 478 | | | AVPL* candidate_start = NULL; |
| 479 | | | AVPL* candidate_stop = NULL; |
| 480 | | | AVPL* is_start = NULL; |
| 481 | | | AVPL* is_stop = NULL; |
| 482 | | | AVPL* gopkey_match = NULL; |
| 483 | | | LoAL* gog_keys = NULL; |
| 484 | | | AVPL* curr_gogkey = NULL; |
| 485 | | | void* cookie = NULL; |
| 486 | | | AVPL* gogkey_match = NULL; |
| 487 | | | gchar* gogkey = NULL; |
| 488 | | | |
| 489 | | | dbg_print (dbg_gop,1,dbg_facility,"analize_pdu: %s",pdu->cfg->name); |
| 490 | | | |
| 491 | | | if (! (cfg = g_hash_table_lookup(mc->gops_by_pduname,pdu->cfg->name)) ) |
Event 1:
g_hash_table_lookup is an Undefined Function.
hide
Event 2:
Skipping " if". cfg = g_hash_table_lookup(...) evaluates to true.
hide
|
|
| 492 | | | return; |
| 493 | | | |
| 494 | | | if ((gopkey_match = new_avpl_exact_match("gop_key_match",pdu->avpl,cfg->key, TRUE))) { |
Event 3:
Skipping " if". !0 evaluates to true.
hide
Event 4:
Taking true branch. gopkey_match = new_avpl_exact_match(...) evaluates to true.
hide
|
|
| 495 | | | gop_key = avpl_to_str(gopkey_match); |
| 496 | | | |
| 497 | | | g_hash_table_lookup_extended(cfg->gop_index,(gconstpointer)gop_key,(gpointer)&orig_gop_key,(gpointer)&gop); |
Event 5:
&gop is passed to g_hash_table_lookup_extended() as the fourth argument.
hide
Event 6:
*(gpointer)&gop is set to an unknown [ ?unknown: the analysis lost precision when tracking this value, so this warning may be a false positive] value , where (gpointer)&gop is &gop. See related event 5.
hide
Event 7:
g_hash_table_lookup_extended is an Undefined Function.
hide
|
|
| 498 | | | |
| 499 | | | if ( gop ) { |
Event 8:
Taking true branch. gop evaluates to true.
hide
|
|
| 500 | | | g_free(gop_key); |
| 501 | | | |
| 502 | | | |
| 503 | | | if ( ! gop->released && |
Event 10:
Skipping " if". - gop->released evaluates to false.
- gop->cfg->lifetime > (0.0) evaluates to false.
- gop->cfg->idle_timeout > (0.0) evaluates to false.
hide
|
|
| 504 | | | ( ( gop->cfg->lifetime > 0.0 && gop->time_to_die >= rd->now) || |
| 505 | | | ( gop->cfg->idle_timeout > 0.0 && gop->time_to_timeout >= rd->now) ) ) { |
| 506 | | | dbg_print (dbg_gop,4,dbg_facility,"analize_pdu: expiring released gop"); |
| 507 | | | gop->released = TRUE; |
| 508 | | | |
| 509 | | | if (gop->gog && gop->cfg->start) gop->gog->num_of_released_gops++; |
| 510 | | | } |
| 511 | | | |
| 512 | | | |
| 513 | | | |
| 514 | | | gop_key = orig_gop_key; |
| 515 | | | |
| 516 | | | dbg_print (dbg_gop,2,dbg_facility,"analize_pdu: got gop: %s",gop_key); |
| 517 | | | |
| 518 | | | if (( candidate_start = cfg->start )) { |
Event 11:
Skipping " if". candidate_start = cfg->start evaluates to false.
hide
|
|
| 519 | | | |
| 520 | | | dbg_print (dbg_gop,2,dbg_facility,"analize_pdu: got candidate start"); |
| 521 | | | |
| 522 | | | if (( is_start = new_avpl_exact_match("",pdu->avpl, candidate_start, FALSE) )) { |
| 523 | | | delete_avpl(is_start,FALSE); |
| 524 | | | if ( gop->released ) { |
| 525 | | | dbg_print (dbg_gop,3,dbg_facility,"analize_pdu: start on released gop, let's create a new gop"); |
| 526 | | | |
| 527 | | | g_hash_table_remove(cfg->gop_index,gop_key); |
| 528 | | | gop->gop_key = NULL; |
| 529 | | | gop = new_gop(cfg,pdu,gop_key); |
| 530 | | | g_hash_table_insert(cfg->gop_index,gop_key,gop); |
| 531 | | | } else { |
| 532 | | | dbg_print (dbg_gop,1,dbg_facility,"analize_pdu: duplicate start on gop"); |
| 533 | | | } |
| 534 | | | } |
| 535 | | | } |
| 536 | | | |
| 537 | | | pdu->gop = gop; |
| 538 | | | |
| 539 | | | if (gop->last_pdu) gop->last_pdu->next = pdu; |
Event 13:
Skipping " if". gop->last_pdu evaluates to false.
hide
|
|
| 540 | | | gop->last_pdu = pdu; |
Event 14:
gop->last_pdu is dereferenced, where gop is the value assigned to *(gpointer)&gop at mate_runtime.c:497. See related events 6 and 12.
hide
|
|
| 541 | | | pdu->next = NULL; |
| 542 | | | pdu->time_in_gop = rd->now - gop->start_time; |
| 543 | | | |
| 544 | | | if (gop->released) pdu->after_release = TRUE; |
Event 15:
Skipping " if". gop->released evaluates to false.
hide
|
|
| 545 | | | |
| 546 | | | } else { |
| 547 | | | |
| 548 | | | dbg_print (dbg_gop,1,dbg_facility,"analize_pdu: no gop already"); |
| 549 | | | |
| 550 | | | if ( ! cfg->start ) { |
| 551 | | | |
| 552 | | | |
| 553 | | | |
| 554 | | | (pdu->avpl,gopkey_match,cfg->); |
| 555 | | | |
| 556 | | | gog_keys = g_hash_table_lookup(mc->gogs_by_gopname,cfg->name); |
| 557 | | | |
| 558 | | | if (gog_keys) { |
| 559 | | | |
| 560 | | | while (( curr_gogkey = get_next_avpl(gog_keys,&cookie) )) { |
| 561 | | | if (( gogkey_match = new_avpl_exact_match(cfg->name,gopkey_match,curr_gogkey,FALSE) )) { |
| 562 | | | gogkey = avpl_to_str(gogkey_match); |
| 563 | | | |
| 564 | | | if (g_hash_table_lookup(cfg->gog_index,gogkey)) { |
| 565 | | | gop = new_gop(cfg,pdu,gop_key); |
| 566 | | | g_hash_table_insert(cfg->gop_index,gop_key,gop); |
| 567 | | | delete_avpl(gogkey_match,FALSE); |
| 568 | | | g_free(gogkey); |
| 569 | | | break; |
| 570 | | | } else { |
| 571 | | | delete_avpl(gogkey_match,FALSE); |
| 572 | | | g_free(gogkey); |
| 573 | | | } |
| 574 | | | } |
| 575 | | | } |
| 576 | | | |
| 577 | | | if ( ! gop ) { |
| 578 | | | g_free(gop_key); |
| 579 | | | delete_avpl(gopkey_match,TRUE); |
| 580 | | | return; |
| 581 | | | } |
| 582 | | | |
| 583 | | | } else { |
| 584 | | | g_free(gop_key); |
| 585 | | | delete_avpl(gopkey_match,TRUE); |
| 586 | | | return; |
| 587 | | | } |
| 588 | | | |
| 589 | | | } else { |
| 590 | | | candidate_start = cfg->start; |
| 591 | | | |
| 592 | | | if (( is_start = new_avpl_exact_match("",pdu->avpl, candidate_start, FALSE) )) { |
| 593 | | | delete_avpl(is_start,FALSE); |
| 594 | | | gop = new_gop(cfg,pdu,gop_key); |
| 595 | | | } else { |
| 596 | | | g_free(gop_key); |
| 597 | | | return; |
| 598 | | | } |
| 599 | | | |
| 600 | | | pdu->gop = gop; |
| 601 | | | } |
| 602 | | | } |
| 603 | | | |
| 604 | | | if (gop->last_pdu) gop->last_pdu->next = pdu; |
Null Test After Dereference
This code tests the nullness of gop->last_pdu, which has already been dereferenced. - If gop->last_pdu were null, there would have been a prior null pointer dereference at mate_runtime.c:537, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related events 6 and 14. Show: All events | Only primary events |
|
| 605 | | | gop->last_pdu = pdu; |
| 606 | | | pdu->next = NULL; |
| 607 | | | |
| 608 | | | pdu->time_in_gop = rd->now - gop->start_time; |
| 609 | | | |
| 610 | | | gop->num_of_pdus++; |
| 611 | | | gop->time_to_timeout = cfg->idle_timeout > 0.0 ? cfg->idle_timeout + rd->now : (float) -1.0 ; |
| 612 | | | |
| 613 | | | dbg_print (dbg_gop,4,dbg_facility,"analize_pdu: merge with key"); |
| 614 | | | |
| 615 | | | merge_avpl(gop->avpl,gopkey_match,TRUE); |
| 616 | | | delete_avpl(gopkey_match,TRUE); |
| 617 | | | |
| 618 | | | dbg_print (dbg_gop,4,dbg_facility,"analize_pdu: apply "); |
| 619 | | | |
| 620 | | | (pdu->avpl,gop->avpl,gop->cfg->); |
| 621 | | | |
| 622 | | | gop->last_time = pdu->rel_time; |
| 623 | | | |
| 624 | | | if ( ! gop->released) { |
| 625 | | | candidate_stop = cfg->stop; |
| 626 | | | |
| 627 | | | if (candidate_stop) { |
| 628 | | | is_stop = new_avpl_exact_match("",pdu->avpl, candidate_stop,FALSE); |
| 629 | | | } else { |
| 630 | | | is_stop = new_avpl(""); |
| 631 | | | } |
| 632 | | | |
| 633 | | | if(is_stop) { |
| 634 | | | dbg_print (dbg_gop,1,dbg_facility,"analize_pdu: is a `stop"); |
| 635 | | | delete_avpl(is_stop,FALSE); |
| 636 | | | |
| 637 | | | if (! gop->released) { |
| 638 | | | gop->released = TRUE; |
| 639 | | | gop->release_time = pdu->rel_time; |
| 640 | | | if (gop->gog && gop->cfg->start) gop->gog->num_of_released_gops++; |
| 641 | | | } |
| 642 | | | |
| 643 | | | pdu->is_stop = TRUE; |
| 644 | | | |
| 645 | | | } |
| 646 | | | } |
| 647 | | | |
| 648 | | | if (gop->last_n != gop->avpl->len) apply_transforms(gop->cfg->transforms,gop->avpl); |
| 649 | | | |
| 650 | | | gop->last_n = gop->avpl->len; |
| 651 | | | |
| 652 | | | if (gop->gog) { |
| 653 | | | reanalyze_gop(gop); |
| 654 | | | } else { |
| 655 | | | analize_gop(gop); |
| 656 | | | } |
| 657 | | | |
| 658 | | | } else { |
| 659 | | | dbg_print (dbg_gop,4,dbg_facility,"analize_pdu: no match for this pdu"); |
| 660 | | | |
| 661 | | | pdu->gop = NULL; |
| 662 | | | } |
| 663 | | | } |
| |