(/home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/asn1/packet-asn1.c) |
| |
| 3079 | | | tbl_type(guint n, GNode *pdu, GNode *list, guint fullindex) |
| 3080 | | | { |
| 3081 | | | GNode *q, *pdu1; |
| 3082 | | | PDUinfo *p, *p1; |
| 3083 | | | guint ni; |
| 3084 | | | guint nvals; |
| 3085 | | | value_string *v; |
| 3086 | | | |
| 3087 | | | if (n > 40) { |
Event 1:
Skipping " if". n > 40 evaluates to false.
hide
|
|
| 3088 | | | g_warning("****tbl_type: n>40, return [recursion too deep] ****************");
x /usr/include/glib-2.0/glib/gmessages.h |
| |
153 | #define g_warning(...) g_log (G_LOG_DOMAIN, \ |
154 | G_LOG_LEVEL_WARNING, \ |
155 | __VA_ARGS__) |
| |
|
| 3089 | | | return; |
| 3090 | | | } |
| 3091 | | | |
| 3092 | | | |
| 3093 | | | |
| 3094 | | | ni = fullindex; |
| 3095 | | | pdu1 = pdu; |
| 3096 | | | while (list) { |
Event 2:
Entering loop body. list evaluates to true.
hide
|
|
| 3097 | | | if (asn1_verbose) |
Event 3:
Skipping " if". asn1_verbose evaluates to false.
hide
|
|
| 3098 | | | g_message("%*s+handle a %s, list=%p", n*2, empty,
x /usr/include/glib-2.0/glib/gmessages.h |
| |
147 | #define g_message(...) g_log (G_LOG_DOMAIN, \ |
148 | G_LOG_LEVEL_MESSAGE, \ |
149 | __VA_ARGS__) |
| |
|
| 3099 | | | data_types[((TBLTag *)list->data)->type], list); |
| 3100 | | | |
| 3101 | | | if (((TBLTag *)list->data)->type == TBLTYPE_Range) { |
Event 4:
Skipping " if". ((TBLTag *)list->data)->type == TBLTYPE_Range evaluates to false.
hide
|
|
| 3102 | | | list = g_node_next_sibling(list);
x /usr/include/glib-2.0/glib/gnode.h |
| |
268 | #define g_node_next_sibling(node) ((node) ? \ |
269 | ((GNode*) (node))->next : NULL) |
| |
|
| 3103 | | | if (asn1_verbose) g_message("%*s*skip range", n*2, empty);
x /usr/include/glib-2.0/glib/gmessages.h |
| |
147 | #define g_message(...) g_log (G_LOG_DOMAIN, \ |
148 | G_LOG_LEVEL_MESSAGE, \ |
149 | __VA_ARGS__) |
| |
|
| 3104 | | | if (list == 0) |
| 3105 | | | break; |
| 3106 | | | } |
| 3107 | | | |
| 3108 | | | |
| 3109 | | | |
| 3110 | | | |
| 3111 | | | |
| 3112 | | | |
| 3113 | | | if (((TBLTag *)list->data)->type == TBLTYPE_Type) { |
Event 5:
Taking false branch. ((TBLTag *)list->data)->type == TBLTYPE_Type evaluates to false.
hide
|
|
| 3114 | | | CHECKTYPE(list, TBLTYPE_Type);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/asn1/packet-asn1.c |
| |
2886 | #define CHECKTYPE(p,x) {if (((TBLTag *)(p)->data)->type != (x)) \ |
2887 | g_warning("**** unexpected type %s, want %s, at line %d", \ |
2888 | data_types[((TBLTag *)p->data)->type], data_types[(x)], __LINE__);} |
| |
x /usr/include/glib-2.0/glib/gmessages.h |
| |
153 | #define g_warning(...) g_log (G_LOG_DOMAIN, \ |
154 | G_LOG_LEVEL_WARNING, \ |
155 | __VA_ARGS__) |
| |
|
| 3115 | | | |
| 3116 | | | p = g_malloc0(sizeof(PDUinfo)); |
| 3117 | | | pdu = g_node_append_data(pdu1, p);
x /usr/include/glib-2.0/glib/gnode.h |
| |
205 | #define g_node_append_data(parent, data) \ |
206 | g_node_insert_before ((parent), NULL, g_node_new (data)) |
| |
|
| 3118 | | | |
| 3119 | | | p->type = ((TBLType *)list->data)->typeId; |
| 3120 | | | p->typename = tbl_types_asn1[p->type]; |
| 3121 | | | p->typenum = -1; |
| 3122 | | | p->mytype = -1; |
| 3123 | | | p->basetype = ((PDUinfo *)pdu1->data)->typenum; |
| 3124 | | | p->flags = PDUinfo_initflags; |
| 3125 | | | p->flags |= (((TBLType *)list->data)->anonymous ? PDU_ANONYMOUS : 0); |
| 3126 | | | p->flags |= (((TBLType *)list->data)->optional ? PDU_OPTIONAL : 0); |
| 3127 | | | |
| 3128 | | | if (((TBLType *)list->data)->fieldName == 0) { |
| 3129 | | | |
| 3130 | | | ((TBLType *)list->data)->fieldName = |
| 3131 | | | g_strdup_printf("anon%d", anonCount++); |
| 3132 | | | } |
| 3133 | | | p->name = ((TBLType *)list->data)->fieldName; |
| 3134 | | | |
| 3135 | | | ni = fullindex; |
| 3136 | | | ni += g_snprintf(&fieldname[ni], sizeof(fieldname) - ni, ".%s", p->name); |
| 3137 | | | p->fullname = g_strdup(fieldname); |
| 3138 | | | |
| 3139 | | | |
| 3140 | | | p->value_id = -1; |
| 3141 | | | p->type_id = -1; |
| 3142 | | | p->value_hf.p_id = &(p->value_id); |
| 3143 | | | p->value_hf.hfinfo.name = p->fullname; |
| 3144 | | | p->value_hf.hfinfo.abbrev = p->fullname; |
| 3145 | | | p->value_hf.hfinfo.type = tbl_types_wireshark[p->type]; |
| 3146 | | | p->value_hf.hfinfo.display = BASE_DEC; |
| 3147 | | | p->value_hf.hfinfo.blurb = p->fullname; |
| 3148 | | | |
| 3149 | | | |
| 3150 | | | if (p->type < TBL__SIMPLE) { |
| 3151 | | | |
| 3152 | | | proto_register_field_array(proto_asn1, &(p->value_hf) , 1); |
| 3153 | | | |
| 3154 | | | save_reference(p); |
| 3155 | | | |
| 3156 | | | if (asn1_verbose) |
| 3157 | | | g_message("register: %3d %3d [%3d] F%2.2x (%s)%s %s %s -> id=%d",
x /usr/include/glib-2.0/glib/gmessages.h |
| |
147 | #define g_message(...) g_log (G_LOG_DOMAIN, \ |
148 | G_LOG_LEVEL_MESSAGE, \ |
149 | __VA_ARGS__) |
| |
|
| 3158 | | | p->mytype, p->typenum, p->basetype, p->flags, |
| 3159 | | | p->typename, p->name, p->fullname, |
| 3160 | | | tbl_types_wireshark_txt[p->type], p->value_id); |
| 3161 | | | } |
| 3162 | | | |
| 3163 | | | q = g_node_first_child(list);
x /usr/include/glib-2.0/glib/gnode.h |
| |
280 | #define g_node_first_child(node) ((node) ? \ |
281 | ((GNode*) (node))->children : NULL) |
| |
|
| 3164 | | | } else { |
| 3165 | | | p = (PDUinfo *)pdu->data; |
| 3166 | | | q = list; |
| 3167 | | | } |
| 3168 | | | |
| 3169 | | | |
| 3170 | | | if (asn1_verbose) g_message("%*s*switch %s %s", n*2, empty, p->name, TBLTYPE(p->type));
x /usr/include/glib-2.0/glib/gmessages.h |
| |
147 | #define g_message(...) g_log (G_LOG_DOMAIN, \ |
148 | G_LOG_LEVEL_MESSAGE, \ |
149 | __VA_ARGS__) |
| |
|
Event 8:
Skipping " if". asn1_verbose evaluates to false.
hide
|
|
| 3171 | | | |
| 3172 | | | switch (p->type) { |
Event 9:
p->type evaluates to 13.
hide
|
|
| 3173 | | | case TBL_BOOLEAN: |
| 3174 | | | case TBL_INTEGER: |
| 3175 | | | case TBL_OCTETSTRING: |
| 3176 | | | case TBL_NULL: |
| 3177 | | | case TBL_OID: |
| 3178 | | | case TBL_REAL: |
| 3179 | | | CHECKTYPE(q, TBLTYPE_Tag);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/asn1/packet-asn1.c |
| |
2886 | #define CHECKTYPE(p,x) {if (((TBLTag *)(p)->data)->type != (x)) \ |
2887 | g_warning("**** unexpected type %s, want %s, at line %d", \ |
2888 | data_types[((TBLTag *)p->data)->type], data_types[(x)], __LINE__);} |
| |
x /usr/include/glib-2.0/glib/gmessages.h |
| |
153 | #define g_warning(...) g_log (G_LOG_DOMAIN, \ |
154 | G_LOG_LEVEL_WARNING, \ |
155 | __VA_ARGS__) |
| |
|
| 3180 | | | p->tclass = ((TBLTag *)q->data)->tclass; |
| 3181 | | | p->tag = ((TBLTag *)q->data)->code; |
| 3182 | | | break; |
| 3183 | | | |
| 3184 | | | case TBL_BITSTRING: |
| 3185 | | | case TBL_ENUMERATED: |
| 3186 | | | CHECKTYPE(q, TBLTYPE_Tag);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/asn1/packet-asn1.c |
| |
2886 | #define CHECKTYPE(p,x) {if (((TBLTag *)(p)->data)->type != (x)) \ |
2887 | g_warning("**** unexpected type %s, want %s, at line %d", \ |
2888 | data_types[((TBLTag *)p->data)->type], data_types[(x)], __LINE__);} |
| |
x /usr/include/glib-2.0/glib/gmessages.h |
| |
153 | #define g_warning(...) g_log (G_LOG_DOMAIN, \ |
154 | G_LOG_LEVEL_WARNING, \ |
155 | __VA_ARGS__) |
| |
|
| 3187 | | | p->tclass = ((TBLTag *)q->data)->tclass; |
| 3188 | | | p->tag = ((TBLTag *)q->data)->code; |
| 3189 | | | if (asn1_verbose) g_message("%*s*collection %s", n*2, empty, p->name);
x /usr/include/glib-2.0/glib/gmessages.h |
| |
147 | #define g_message(...) g_log (G_LOG_DOMAIN, \ |
148 | G_LOG_LEVEL_MESSAGE, \ |
149 | __VA_ARGS__) |
| |
|
| 3190 | | | |
| 3191 | | | nvals = 0; |
| 3192 | | | p1 = p; |
| 3193 | | | while((q = g_node_next_sibling(q))) {
x /usr/include/glib-2.0/glib/gnode.h |
| |
268 | #define g_node_next_sibling(node) ((node) ? \ |
269 | ((GNode*) (node))->next : NULL) |
| |
|
| 3194 | | | CHECKTYPE(q, TBLTYPE_NamedNumber);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/asn1/packet-asn1.c |
| |
2886 | #define CHECKTYPE(p,x) {if (((TBLTag *)(p)->data)->type != (x)) \ |
2887 | g_warning("**** unexpected type %s, want %s, at line %d", \ |
2888 | data_types[((TBLTag *)p->data)->type], data_types[(x)], __LINE__);} |
| |
x /usr/include/glib-2.0/glib/gmessages.h |
| |
153 | #define g_warning(...) g_log (G_LOG_DOMAIN, \ |
154 | G_LOG_LEVEL_WARNING, \ |
155 | __VA_ARGS__) |
| |
|
| 3195 | | | p = g_malloc0(sizeof(PDUinfo)); |
| 3196 | | | nvals++; |
| 3197 | | | p->type = TBL_ENUMERATED; |
| 3198 | | | p->name = (gchar *)(((TBLNamedNumber *)q->data)->name); |
| 3199 | | | p->tag = (((TBLNamedNumber *)q->data)->value); |
| 3200 | | | p->flags = PDU_NAMEDNUM; |
| 3201 | | | if (asn1_verbose) g_message("%*s %3d %s", n*2, empty, p->tag, p->name);
x /usr/include/glib-2.0/glib/gmessages.h |
| |
147 | #define g_message(...) g_log (G_LOG_DOMAIN, \ |
148 | G_LOG_LEVEL_MESSAGE, \ |
149 | __VA_ARGS__) |
| |
|
| 3202 | | | g_node_append_data(pdu, p);
x /usr/include/glib-2.0/glib/gnode.h |
| |
205 | #define g_node_append_data(parent, data) \ |
206 | g_node_insert_before ((parent), NULL, g_node_new (data)) |
| |
|
| 3203 | | | } |
| 3204 | | | |
| 3205 | | | |
| 3206 | | | p1->value_hf.hfinfo.strings = v = g_malloc0((nvals+1) * sizeof(value_string)); |
| 3207 | | | q = g_node_first_child(pdu);
x /usr/include/glib-2.0/glib/gnode.h |
| |
280 | #define g_node_first_child(node) ((node) ? \ |
281 | ((GNode*) (node))->children : NULL) |
| |
|
| 3208 | | | nvals = 0; |
| 3209 | | | while(q) { |
| 3210 | | | p = (PDUinfo *)q->data; |
| 3211 | | | v[nvals].value = p->tag; |
| 3212 | | | v[nvals].strptr = p->name; |
| 3213 | | | |
| 3214 | | | nvals++; |
| 3215 | | | q = g_node_next_sibling(q);
x /usr/include/glib-2.0/glib/gnode.h |
| |
268 | #define g_node_next_sibling(node) ((node) ? \ |
269 | ((GNode*) (node))->next : NULL) |
| |
|
| 3216 | | | } |
| 3217 | | | |
| 3218 | | | |
| 3219 | | | break; |
| 3220 | | | |
| 3221 | | | case TBL_SEQUENCE: |
| 3222 | | | case TBL_SET: |
| 3223 | | | case TBL_SEQUENCEOF: |
| 3224 | | | case TBL_SETOF: |
| 3225 | | | case TBL_CHOICE: |
| 3226 | | | CHECKTYPE(q, TBLTYPE_Tag);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/asn1/packet-asn1.c |
| |
2886 | #define CHECKTYPE(p,x) {if (((TBLTag *)(p)->data)->type != (x)) \ |
2887 | g_warning("**** unexpected type %s, want %s, at line %d", \ |
2888 | data_types[((TBLTag *)p->data)->type], data_types[(x)], __LINE__);} |
| |
x /usr/include/glib-2.0/glib/gmessages.h |
| |
153 | #define g_warning(...) g_log (G_LOG_DOMAIN, \ |
154 | G_LOG_LEVEL_WARNING, \ |
155 | __VA_ARGS__) |
| |
|
| 3227 | | | q = g_node_first_child(list);
x /usr/include/glib-2.0/glib/gnode.h |
| |
280 | #define g_node_first_child(node) ((node) ? \ |
281 | ((GNode*) (node))->children : NULL) |
| |
|
| 3228 | | | tbl_type(n+1, pdu, q, ni); |
| 3229 | | | break; |
| 3230 | | | |
| 3231 | | | case TBL_TYPEREF: { |
| 3232 | | | TypeRef *tr; |
| 3233 | | | guint i; |
| 3234 | | | if(!q){ |
Null Test After Dereference
This code tests the nullness of q, which has already been dereferenced. - If q were null, there would have been a prior null pointer dereference at packet-asn1.c:3113, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 7. Show: All events | Only primary events |
|
| 3235 | | | break; |
| 3236 | | | } |
| 3237 | | | if ( ((TBLTag *)q->data)->type == TBLTYPE_Tag) { |
| 3238 | | | if ((p->flags & PDU_IMPLICIT) == 0) { |
| 3239 | | | p->tclass = ((TBLTag *)q->data)->tclass; |
| 3240 | | | p->tag = ((TBLTag *)q->data)->code; |
| 3241 | | | if (asn1_verbose) |
| 3242 | | | g_message("%*s*insert type tag %c%d", n*2, empty,
x /usr/include/glib-2.0/glib/gmessages.h |
| |
147 | #define g_message(...) g_log (G_LOG_DOMAIN, \ |
148 | G_LOG_LEVEL_MESSAGE, \ |
149 | __VA_ARGS__) |
| |
|
| 3243 | | | tag_class[p->tclass], p->tag); |
| 3244 | | | } |
| 3245 | | | q = g_node_next_sibling(q);
x /usr/include/glib-2.0/glib/gnode.h |
| |
268 | #define g_node_next_sibling(node) ((node) ? \ |
269 | ((GNode*) (node))->next : NULL) |
| |
|
| 3246 | | | } else { |
| 3247 | | | tr = &typeDef_names[((TBLTypeRef *)q->data)->typeDefId]; |
| 3248 | | | if ((((p->flags & PDU_IMPLICIT) == 0) && (tr->defclass != BER_CLASS_UNI)) || |
| 3249 | | | ((p->tclass | p->tag) == 0 )) { |
| 3250 | | | |
| 3251 | | | p->tclass = tr->defclass; |
| 3252 | | | p->tag = tr->deftag; |
| 3253 | | | if (asn1_verbose) g_message("%*s*set tag %c%d", n*2, empty,
x /usr/include/glib-2.0/glib/gmessages.h |
| |
147 | #define g_message(...) g_log (G_LOG_DOMAIN, \ |
148 | G_LOG_LEVEL_MESSAGE, \ |
149 | __VA_ARGS__) |
| |
|
| 3254 | | | tag_class[p->tclass], p->tag); |
| 3255 | | | } |
| 3256 | | | } |
| 3257 | | | CHECKTYPE(q, TBLTYPE_TypeRef);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/asn1/packet-asn1.c |
| |
2886 | #define CHECKTYPE(p,x) {if (((TBLTag *)(p)->data)->type != (x)) \ |
2887 | g_warning("**** unexpected type %s, want %s, at line %d", \ |
2888 | data_types[((TBLTag *)p->data)->type], data_types[(x)], __LINE__);} |
| |
x /usr/include/glib-2.0/glib/gmessages.h |
| |
153 | #define g_warning(...) g_log (G_LOG_DOMAIN, \ |
154 | G_LOG_LEVEL_WARNING, \ |
155 | __VA_ARGS__) |
| |
|
| 3258 | | | i = ((TBLTypeRef *)q->data)->typeDefId; |
| 3259 | | | p->mytype = i; |
| 3260 | | | tr = &typeDef_names[i]; |
| 3261 | | | if (asn1_verbose) |
| 3262 | | | g_message("%*s*type#%d %s, %p", n*2, empty, i, tr->name, tr->pdu);
x /usr/include/glib-2.0/glib/gmessages.h |
| |
147 | #define g_message(...) g_log (G_LOG_DOMAIN, \ |
148 | G_LOG_LEVEL_MESSAGE, \ |
149 | __VA_ARGS__) |
| |
|
| 3263 | | | p->typename = tr->name; |
| 3264 | | | |
| 3265 | | | if (tr->defclass == CLASSREF) { |
| 3266 | | | if (tr->pdu == 0) |
| 3267 | | | tr->pdu = pdu; |
| 3268 | | | i = tr->deftag; |
| 3269 | | | tr = &typeDef_names[i]; |
| 3270 | | | if (asn1_verbose) |
| 3271 | | | g_message("%*s*refer to type#%d %s, %p", n*2, empty,
x /usr/include/glib-2.0/glib/gmessages.h |
| |
147 | #define g_message(...) g_log (G_LOG_DOMAIN, \ |
148 | G_LOG_LEVEL_MESSAGE, \ |
149 | __VA_ARGS__) |
| |
|
| 3272 | | | i, tr->name, tr->pdu); |
| 3273 | | | } |
| 3274 | | | |
| 3275 | | | if ((tr->pdu == 0) || (tr->level < type_recursion_level)) { |
| 3276 | | | tr->level++; |
| 3277 | | | if (tr->pdu == 0) { |
| 3278 | | | tr->pdu = pdu; |
| 3279 | | | } |
| 3280 | | | p->flags |= ((TBLTypeRef *)q->data)->implicit? PDU_IMPLICIT : 0; |
| 3281 | | | if (asn1_verbose) |
| 3282 | | | g_message("%*s*typeref %s > %s%s at %p", n*2, empty,
x /usr/include/glib-2.0/glib/gmessages.h |
| |
147 | #define g_message(...) g_log (G_LOG_DOMAIN, \ |
148 | G_LOG_LEVEL_MESSAGE, \ |
149 | __VA_ARGS__) |
| |
|
| 3283 | | | p->name, |
| 3284 | | | ((TBLTypeRef *)q->data)->implicit?"implicit ":empty, |
| 3285 | | | tr->name, |
| 3286 | | | pdu); |
| 3287 | | | tbl_typeref(n+1, pdu, tr->type, ni); |
| 3288 | | | tr->level--; |
| 3289 | | | } else { |
| 3290 | | | if (asn1_verbose) |
| 3291 | | | g_message("%*s*typeref %s > %s already at %p", n*2, empty,
x /usr/include/glib-2.0/glib/gmessages.h |
| |
147 | #define g_message(...) g_log (G_LOG_DOMAIN, \ |
148 | G_LOG_LEVEL_MESSAGE, \ |
149 | __VA_ARGS__) |
| |
|
| 3292 | | | p->name, tr->name, tr->pdu); |
| 3293 | | | p->flags |= PDU_REFERENCE; |
| 3294 | | | p->reference = tr->pdu; |
| 3295 | | | } |
| 3296 | | | }; |
| 3297 | | | break; |
| 3298 | | | default: |
| 3299 | | | g_warning("**** unknown tbl-type %d at line %d", p->type, __LINE__);
x /usr/include/glib-2.0/glib/gmessages.h |
| |
153 | #define g_warning(...) g_log (G_LOG_DOMAIN, \ |
154 | G_LOG_LEVEL_WARNING, \ |
155 | __VA_ARGS__) |
| |
|
| 3300 | | | break; |
| 3301 | | | } |
| 3302 | | | |
| 3303 | | | if (asn1_verbose) |
| 3304 | | | g_message("%*sinclude type %s %s [%p:%s, tag %c%d]",
x /usr/include/glib-2.0/glib/gmessages.h |
| |
147 | #define g_message(...) g_log (G_LOG_DOMAIN, \ |
148 | G_LOG_LEVEL_MESSAGE, \ |
149 | __VA_ARGS__) |
| |
|
| 3305 | | | n*2, empty, p->name, p->typename, p, TBLTYPE(p->type), |
| 3306 | | | tag_class[p->tclass], p->tag); |
| 3307 | | | |
| 3308 | | | if (p->value_id == -1) { |
| 3309 | | | proto_register_field_array(proto_asn1, &(p->value_hf) , 1); |
| 3310 | | | |
| 3311 | | | save_reference(p); |
| 3312 | | | |
| 3313 | | | if (asn1_verbose) |
| 3314 | | | g_message("regist-2: %3d %3d [%3d] F%2.2x (%s)%s %s %s -> id=%d",
x /usr/include/glib-2.0/glib/gmessages.h |
| |
147 | #define g_message(...) g_log (G_LOG_DOMAIN, \ |
148 | G_LOG_LEVEL_MESSAGE, \ |
149 | __VA_ARGS__) |
| |
|
| 3315 | | | p->mytype, p->typenum, p->basetype, p->flags, p->typename, |
| 3316 | | | p->name, p->fullname, |
| 3317 | | | tbl_types_wireshark_txt[p->type], p->value_id); |
| 3318 | | | } |
| 3319 | | | list = g_node_next_sibling(list);
x /usr/include/glib-2.0/glib/gnode.h |
| |
268 | #define g_node_next_sibling(node) ((node) ? \ |
269 | ((GNode*) (node))->next : NULL) |
| |
|
| 3320 | | | } |
| 3321 | | | } |
| |