(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-quakeworld.c) |
| |
| 356 | | | dissect_quakeworld_ConnectionlessPacket(tvbuff_t *tvb, packet_info *pinfo, |
| 357 | | | proto_tree *tree, int direction) |
| 358 | | | { |
| 359 | | | proto_tree *cl_tree = NULL; |
| 360 | | | proto_item *cl_item = NULL; |
| 361 | | | proto_item *text_item = NULL; |
| 362 | | | proto_tree *text_tree = NULL; |
| 363 | | | guint8 text[MAX_TEXT_SIZE+1]; |
| 364 | | | int len; |
| 365 | | | int offset; |
| 366 | | | guint32 marker; |
| 367 | | | int command_len; |
| 368 | | | char *command=""; |
| 369 | | | int command_finished = FALSE; |
| 370 | | | |
| 371 | | | |
| 372 | | | marker = tvb_get_ntohl(tvb, 0); |
| 373 | | | if (tree) { |
Event 1:
Taking true branch. tree evaluates to true.
hide
|
|
| 374 | | | cl_item = proto_tree_add_text(tree, tvb, |
| 375 | [+] | | 0, -1, "Connectionless"); |
 |
| 376 | | | if (cl_item) |
Event 12:
Taking true branch. cl_item evaluates to true.
hide
|
|
| 377 | | | cl_tree = proto_item_add_subtree( |
| 378 | | | cl_item, ett_quakeworld_connectionless); |
| 379 | | | } |
| 380 | | | |
| 381 | | | if (cl_tree) { |
Event 13:
Taking true branch. cl_tree evaluates to true.
hide
|
|
| 382 | | | proto_tree_add_uint(cl_tree, hf_quakeworld_connectionless_marker, |
| 383 | | | tvb, 0, 4, marker); |
| 384 | | | } |
| 385 | | | |
| 386 | | | |
| 387 | | | offset = 4; |
| 388 | | | |
| 389 | | | len = tvb_get_nstringz0(tvb, offset, sizeof(text), text); |
| 390 | | | |
| 391 | | | |
| 392 | | | if (cl_tree) { |
Event 14:
Taking true branch. cl_tree evaluates to true.
hide
|
|
| 393 | | | text_item = proto_tree_add_string(cl_tree, hf_quakeworld_connectionless_text, |
| 394 | | | tvb, offset, len + 1, text); |
| 395 | | | if (text_item) { |
Event 15:
Taking true branch. text_item evaluates to true.
hide
|
|
| 396 | | | text_tree = proto_item_add_subtree( |
| 397 | | | text_item, ett_quakeworld_connectionless_text); |
| 398 | | | } |
| 399 | | | } |
| 400 | | | |
| 401 | | | if (direction == DIR_C2S) { |
Event 16:
Taking true branch. direction == 0 evaluates to true.
hide
|
|
| 402 | | | |
| 403 | | | const char *c; |
| 404 | | | |
| 405 | | | Cmd_TokenizeString(text); |
| 406 | | | c = Cmd_Argv(0); |
| 407 | | | |
| 408 | | | |
| 409 | | | if (strcmp(c,"ping") == 0) { |
Event 17:
Taking false branch. strcmp(c, "ping") == 0 evaluates to false.
hide
|
|
| 410 | | | command="Ping"; |
| 411 | | | command_len = 4; |
| 412 | | | } else if (strcmp(c,"status") == 0) { |
Event 18:
Taking false branch. strcmp(c, "status") == 0 evaluates to false.
hide
|
|
| 413 | | | command="Status"; |
| 414 | | | command_len = 6; |
| 415 | | | } else if (strcmp(c,"log") == 0) { |
Event 19:
Taking false branch. strcmp(c, "log") == 0 evaluates to false.
hide
|
|
| 416 | | | command="Log"; |
| 417 | | | command_len = 3; |
| 418 | | | } else if (strcmp(c,"connect") == 0) { |
Event 20:
Taking true branch. strcmp(c, "connect") == 0 evaluates to true.
hide
|
|
| 419 | | | int version; |
| 420 | | | int qport; |
| 421 | | | int challenge; |
| 422 | | | const char *infostring; |
| 423 | | | proto_item *argument_item = NULL; |
| 424 | | | proto_tree *argument_tree = NULL; |
| 425 | | | proto_item *info_item = NULL; |
| 426 | | | proto_tree *info_tree = NULL; |
| 427 | | | command="Connect"; |
| 428 | | | command_len = Cmd_Argv_length(0); |
| 429 | | | if (text_tree) { |
Event 21:
Taking true branch. text_tree evaluates to true.
hide
|
|
| 430 | | | proto_tree_add_string(text_tree, hf_quakeworld_connectionless_command, |
| 431 | | | tvb, offset, command_len, command); |
| 432 | | | argument_item = proto_tree_add_string(text_tree, |
| 433 | | | hf_quakeworld_connectionless_arguments, |
| 434 | | | tvb, offset + Cmd_Argv_start(1), len + 1 - Cmd_Argv_start(1), |
| 435 | | | text + Cmd_Argv_start(1)); |
| 436 | | | if (argument_item) { |
Event 22:
Taking true branch. argument_item evaluates to true.
hide
|
|
| 437 | | | argument_tree = |
| 438 | | | proto_item_add_subtree(argument_item, |
| 439 | | | ett_quakeworld_connectionless_arguments); |
| 440 | | | } |
| 441 | | | command_finished=TRUE; |
Event 23:
!0 evaluates to true.
hide
|
|
| 442 | | | } |
| 443 | | | version = atoi(Cmd_Argv(1)); |
| 444 | | | qport = atoi(Cmd_Argv(2)); |
| 445 | | | challenge = atoi(Cmd_Argv(3)); |
Event 24:
atoi() returns a potentially dangerous value [ ?potentially dangerous: the value cannot be determined and may come from program input]. - Determines the value that is cast in the Cast Alters Value warning later.
hide
Event 25:
challenge is set to atoi(Cmd_Argv(3)). See related event 24.
hide
|
|
| 446 | | | infostring = Cmd_Argv(4); |
| 447 | | | if (argument_tree) { |
Event 26:
Taking true branch. argument_tree evaluates to true.
hide
|
|
| 448 | | | proto_tree_add_uint(argument_tree, |
| 449 | | | hf_quakeworld_connectionless_connect_version, |
| 450 | | | tvb, |
| 451 | | | offset + Cmd_Argv_start(1), |
| 452 | | | Cmd_Argv_length(1), version); |
| 453 | | | proto_tree_add_uint(argument_tree, |
| 454 | | | hf_quakeworld_connectionless_connect_qport, |
| 455 | | | tvb, |
| 456 | | | offset + Cmd_Argv_start(2), |
| 457 | | | Cmd_Argv_length(2), qport); |
| 458 | | | proto_tree_add_int(argument_tree, |
| 459 | | | hf_quakeworld_connectionless_connect_challenge, |
| 460 | | | tvb, |
| 461 | | | offset + Cmd_Argv_start(3), |
| 462 | [+] | | Cmd_Argv_length(3), challenge); |
Event 27:
challenge, which evaluates to atoi(Cmd_Argv(3)) from packet-quakeworld.c:445, is passed to proto_tree_add_int() as the sixth argument. See related event 25.
hide
|
|
 |
| |