(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-ip.c) |
| |
| 1200 | | | dissect_ip_tcp_options(tvbuff_t *tvb, int offset, guint length, |
| 1201 | | | const ip_tcp_opt *opttab, int nopts, int eol, |
| 1202 | | | packet_info *pinfo, proto_tree *opt_tree) |
| 1203 | | | { |
| 1204 | | | guchar opt; |
| 1205 | | | const ip_tcp_opt *optp; |
| 1206 | | | opt_len_type len_type; |
| 1207 | | | unsigned int optlen; |
| 1208 | | | const char *name; |
| 1209 | | | void (*dissect)(const struct ip_tcp_opt *, tvbuff_t *, |
| 1210 | | | int, guint, packet_info *, proto_tree *); |
| 1211 | | | guint len; |
| 1212 | | | |
| 1213 | | | while (length > 0) { |
Event 1:
Performing all but the last two loop iterations.
hide
Event 2:
Continuing from loop body. Entering loop body. length > 0 evaluates to true.
hide
|
|
| 1214 | | | opt = tvb_get_guint8(tvb, offset); |
| 1215 | | | for (optp = &opttab[0]; optp < &opttab[nopts]; optp++) { |
Event 3:
Leaving loop. optp < &opttab[nopts] evaluates to false.
hide
|
|
| 1216 | | | if (optp->optcode == opt) |
| 1217 | | | break; |
| 1218 | | | } |
| 1219 | | | if (optp == &opttab[nopts]) { |
Event 4:
Taking false branch. optp == &opttab[nopts] evaluates to false.
hide
|
|
| 1220 | | | |
| 1221 | | | |
| 1222 | | | |
| 1223 | | | |
| 1224 | | | optp = NULL; |
| 1225 | | | len_type = VARIABLE_LENGTH; |
| 1226 | | | optlen = 2; |
| 1227 | | | name = ep_strdup_printf("Unknown (0x%02x)", opt); |
| 1228 | | | dissect = NULL; |
| 1229 | | | } else { |
| 1230 | | | len_type = optp->len_type; |
| 1231 | | | optlen = optp->optlen; |
| 1232 | | | name = optp->name; |
| 1233 | | | dissect = optp->dissect; |
| 1234 | | | } |
| 1235 | | | --length; |
| 1236 | | | if (len_type != NO_LENGTH) { |
Event 6:
Taking true branch. len_type != NO_LENGTH evaluates to true.
hide
|
|
| 1237 | | | |
| 1238 | | | if (length == 0) { |
Event 7:
Skipping " if". length == 0 evaluates to false.
hide
|
|
| 1239 | | | |
| 1240 | | | |
| 1241 | | | proto_tree_add_text(opt_tree, tvb, offset, 1, |
| 1242 | | | "%s (length byte past end of options)", name); |
| 1243 | | | return; |
| 1244 | | | } |
| 1245 | | | len = tvb_get_guint8(tvb, offset + 1); |
| 1246 | | | --length; |
| 1247 | | | if (len < 2) { |
Event 8:
Taking false branch. len < 2 evaluates to false.
hide
|
|
| 1248 | | | |
| 1249 | | | |
| 1250 | | | proto_tree_add_text(opt_tree, tvb, offset, 2, |
| 1251 | | | "%s (with too-short option length = %u byte%s)", name, |
| 1252 | | | len, plurality(len, "", "s")); |
| 1253 | | | return; |
| 1254 | | | } else if (len - 2 > length) { |
Event 9:
Taking false branch. len - 2 > length evaluates to false.
hide
|
|
| 1255 | | | |
| 1256 | | | proto_tree_add_text(opt_tree, tvb, offset, length, |
| 1257 | | | "%s (option length = %u byte%s says option goes past end of options)", |
| 1258 | | | name, len, plurality(len, "", "s")); |
| 1259 | | | return; |
| 1260 | | | } else if (len_type == FIXED_LENGTH && len != optlen) { |
Event 10:
Taking false branch. len_type == FIXED_LENGTH evaluates to false.
hide
|
|
| 1261 | | | |
| 1262 | | | |
| 1263 | | | proto_tree_add_text(opt_tree, tvb, offset, len, |
| 1264 | | | "%s (with option length = %u byte%s; should be %u)", name, |
| 1265 | | | len, plurality(len, "", "s"), optlen); |
| 1266 | | | return; |
| 1267 | | | } else if (len_type == VARIABLE_LENGTH && len < optlen) { |
Event 11:
Taking false branch. len_type == VARIABLE_LENGTH evaluates to false.
hide
|
|
| 1268 | | | |
| 1269 | | | |
| 1270 | | | proto_tree_add_text(opt_tree, tvb, offset, len, |
| 1271 | | | "%s (with option length = %u byte%s; should be >= %u)", name, |
| 1272 | | | len, plurality(len, "", "s"), optlen); |
| 1273 | | | return; |
| 1274 | | | } else { |
| 1275 | | | if (optp == NULL) { |
Null Test After Dereference
This code tests the nullness of optp, which has already been dereferenced. - If optp were null, there would have been a prior null pointer dereference at packet-ip.c:1233, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 5. Show: All events | Only primary events |
|
| 1276 | | | proto_tree_add_text(opt_tree, tvb, offset, len, "%s (%u byte%s)", |
| 1277 | | | name, len, plurality(len, "", "s")); |
| 1278 | | | } else { |
| 1279 | | | if (dissect != NULL) { |
| 1280 | | | |
| 1281 | | | (*dissect)(optp, tvb, offset, len, pinfo, opt_tree); |
| 1282 | | | } else { |
| 1283 | | | |
| 1284 | | | proto_tree_add_text(opt_tree, tvb, offset, len, "%s", name); |
| 1285 | | | } |
| 1286 | | | } |
| 1287 | | | len -= 2; |
| 1288 | | | offset += 2 + len; |
| 1289 | | | } |
| 1290 | | | length -= len; |
| 1291 | | | } else { |
| 1292 | | | proto_tree_add_text(opt_tree, tvb, offset, 1, "%s", name); |
| 1293 | | | offset += 1; |
| 1294 | | | } |
| 1295 | | | if (opt == eol) |
| 1296 | | | break; |
| 1297 | | | } |
| 1298 | | | } |
| |