(/home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/profinet/packet-dcom-cba-acco.c) |
| |
| 2662 | | | dissect_ICBAAccoServerSRT_Connect_resp(tvbuff_t *tvb, int offset, |
| 2663 | | | packet_info *pinfo, proto_tree *tree, guint8 *drep) |
| 2664 | | | { |
| 2665 | | | guint32 u32Pointer; |
| 2666 | | | guint32 u32ArraySize; |
| 2667 | | | guint32 u32Idx = 1; |
| 2668 | | | proto_item *sub_item; |
| 2669 | | | proto_tree *sub_tree; |
| 2670 | | | guint32 u32SubStart; |
| 2671 | | | guint32 u32ProvID; |
| 2672 | | | guint32 u32HResult; |
| 2673 | | | proto_item *item; |
| 2674 | | | dcerpc_info *info = (dcerpc_info *)pinfo->private_data; |
| 2675 | | | server_connect_call_t *call = info->call_data->private_data; |
| 2676 | | | cba_connection_t *conn; |
| 2677 | | | |
| 2678 | | | |
| 2679 | | | offset = dissect_dcom_that(tvb, offset, pinfo, tree, drep); |
| 2680 | | | |
| 2681 | | | if(call == NULL) { |
Event 1:
Skipping " if". call == (void *)0 evaluates to false.
hide
|
|
| 2682 | | | expert_add_info_format(pinfo, NULL, PI_UNDECODED, PI_NOTE, |
| 2683 | | | "No request info, response data ignored"); |
| 2684 | | | } |
| 2685 | | | |
| 2686 | | | item = proto_tree_add_boolean (tree, hf_cba_acco_srt_call, tvb, offset, 0, FALSE); |
| 2687 | | | PROTO_ITEM_SET_GENERATED(item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
325 | #define PROTO_ITEM_SET_GENERATED(proto_item) \ |
326 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_GENERATED) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
Event 2:
item evaluates to false.
hide
|
|
| 2688 | | | pinfo->profinet_type = 3; |
| 2689 | | | |
| 2690 | | | offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, tree, drep, |
| 2691 | | | &u32Pointer); |
| 2692 | | | |
| 2693 | | | if(call && call->frame != NULL) { |
Event 3:
Skipping " if". - call evaluates to true.
- call->frame != (void *)0 evaluates to false.
hide
|
|
| 2694 | | | cba_frame_info(tvb, pinfo, tree, call->frame); |
| 2695 | | | } |
| 2696 | | | |
| 2697 | | | if (u32Pointer) { |
Event 5:
Taking true branch. u32Pointer evaluates to true.
hide
|
|
| 2698 | | | offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, tree, drep, |
| 2699 | | | &u32ArraySize); |
| 2700 | | | |
| 2701 | | | |
| 2702 | | | while(u32ArraySize--) { |
Event 6:
Entering loop body. u32ArraySize-- evaluates to true.
hide
|
|
| 2703 | | | sub_item = proto_tree_add_item(tree, hf_cba_connectout, tvb, offset, 8, FALSE); |
| 2704 | | | sub_tree = proto_item_add_subtree(sub_item, ett_cba_connectout); |
| 2705 | | | u32SubStart = offset; |
| 2706 | | | |
| 2707 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 2708 | | | hf_cba_acco_conn_prov_id, &u32ProvID); |
| 2709 | | | |
| 2710 | | | offset = dissect_dcom_indexed_HRESULT(tvb, offset, pinfo, sub_tree, drep, |
| 2711 | | | &u32HResult, u32Idx); |
| 2712 | | | |
| 2713 | | | |
| 2714 | | | if(call && u32Idx <= call->conn_count) { |
Null Test After Dereference
This code tests the nullness of call, which has already been dereferenced. - If call were null, there would have been a prior null pointer dereference at packet-dcom-cba-acco.c:2693, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 4. Show: All events | Only primary events |
|
| 2715 | | | conn = call->conns[u32Idx-1]; |
| 2716 | | | conn->provid = u32ProvID; |
| 2717 | | | conn->connret = u32HResult; |
| 2718 | | | |
| 2719 | | | cba_connection_info(tvb, pinfo, sub_tree, conn); |
| 2720 | | | } |
| 2721 | | | |
| 2722 | | | proto_item_append_text(sub_item, "[%u]: ProvID=0x%x %s", |
| 2723 | | | u32Idx, u32ProvID, |
| 2724 | | | val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") ); |
| 2725 | | | proto_item_set_len(sub_item, offset - u32SubStart); |
| 2726 | | | |
| 2727 | | | u32Idx++; |
| 2728 | | | } |
| 2729 | | | } |
| 2730 | | | |
| 2731 | | | offset = dissect_dcom_HRESULT(tvb, offset, pinfo, tree, drep, |
| 2732 | | | &u32HResult); |
| 2733 | | | |
| 2734 | | | |
| 2735 | | | while(call && u32Idx <= call->conn_count) { |
| 2736 | | | conn = call->conns[u32Idx-1]; |
| 2737 | | | conn->provid = 0; |
| 2738 | | | conn->connret = u32HResult; |
| 2739 | | | u32Idx++; |
| 2740 | | | } |
| 2741 | | | |
| 2742 | | | if (check_col(pinfo->cinfo, COL_INFO)) { |
| 2743 | | | col_append_fstr(pinfo->cinfo, COL_INFO, ": Cnt=%u -> %s", |
| 2744 | | | u32Idx-1, |
| 2745 | | | val_to_str(u32HResult, dcom_hresult_vals, "Unknown (0x%08x)") ); |
| 2746 | | | } |
| 2747 | | | |
| 2748 | | | return offset; |
| 2749 | | | } |
| |