(/home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/profinet/packet-dcom-cba-acco.c) |
| |
| 1661 | | | dissect_ICBAAccoServer_Disconnect_rqst(tvbuff_t *tvb, int offset, |
| 1662 | | | packet_info *pinfo, proto_tree *tree, guint8 *drep) |
| 1663 | | | { |
| 1664 | | | guint32 u32Count; |
| 1665 | | | guint32 u32ArraySize; |
| 1666 | | | guint32 u32Idx; |
| 1667 | | | guint32 u32ProvID; |
| 1668 | | | proto_item *item; |
| 1669 | | | dcerpc_info *info = (dcerpc_info *)pinfo->private_data; |
| 1670 | | | cba_ldev_t *prov_ldev; |
| 1671 | | | cba_connection_t *conn; |
| 1672 | | | server_connect_call_t *call; |
| 1673 | | | |
| 1674 | | | |
| 1675 | | | offset = dissect_dcom_this(tvb, offset, pinfo, tree, drep); |
| 1676 | | | |
| 1677 | | | item = proto_tree_add_boolean (tree, hf_cba_acco_dcom_call, tvb, offset, 0, TRUE); |
Event 1:
!0 evaluates to true.
hide
|
|
| 1678 | | | PROTO_ITEM_SET_GENERATED(item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
325 | #define PROTO_ITEM_SET_GENERATED(proto_item) \ |
326 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_GENERATED) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
Event 2:
item evaluates to false.
hide
|
|
| 1679 | | | pinfo->profinet_type = 2; |
| 1680 | | | |
| 1681 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, tree, drep, |
| 1682 | | | hf_cba_acco_count, &u32Count); |
| 1683 | | | |
| 1684 | | | offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, drep, |
| 1685 | [+] | | &u32ArraySize); |
Event 3:
dissect_dcom_dcerpc_array_size() does not initialize u32ArraySize. - This may be because of a failure case or other special case for dissect_dcom_dcerpc_array_size().
hide
|
|
 |
| 1686 | | | |
| 1687 | | | prov_ldev = cba_ldev_find(pinfo, pinfo->net_dst.data, &info->call_data->object_uuid); |
| 1688 | | | |
| 1689 | | | |
| 1690 | | | if(prov_ldev != NULL) { |
Event 7:
Taking true branch. prov_ldev != (void *)0 evaluates to true.
hide
|
|
| 1691 | | | call = se_alloc(sizeof(server_connect_call_t) + u32ArraySize * sizeof(cba_connection_t *)); |
Uninitialized Variable
u32ArraySize was not initialized. The issue can occur if the highlighted code executes. See related events 3 and 5. Show: All events | Only primary events |
|
| |