(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-mgcp.c) |
| |
| 1980 | | | dissect_mgcp_localconnectionoptions(proto_tree *parent_tree, tvbuff_t *tvb, gint offset, gint param_type_len, gint param_val_len) |
| 1981 | | | { |
| 1982 | | | proto_tree *tree = parent_tree; |
| 1983 | | | proto_item *item = NULL; |
| 1984 | | | |
| 1985 | | | gchar *tokenline = NULL; |
| 1986 | | | gchar **tokens = NULL; |
| 1987 | | | gchar **typval = NULL; |
| 1988 | | | guint i = 0; |
| 1989 | | | guint tokenlen = 0; |
| 1990 | | | int hf_uint = -1; |
| 1991 | | | int hf_string = -1; |
| 1992 | | | |
| 1993 | | | if (parent_tree) |
Event 1:
Skipping " if". parent_tree evaluates to false.
hide
|
|
| 1994 | | | { |
| 1995 | | | item = proto_tree_add_item(parent_tree, hf_mgcp_param_localconnoptions, tvb, offset, param_type_len+param_val_len, FALSE); |
| 1996 | | | tree = proto_item_add_subtree(item, ett_mgcp_param_localconnectionoptions); |
| 1997 | | | } |
| 1998 | | | |
| 1999 | | | |
| 2000 | | | offset += param_type_len; |
| 2001 | | | tokenline = tvb_get_ephemeral_string(tvb, offset, param_val_len); |
| 2002 | | | |
| 2003 | | | |
| 2004 | | | tokens = ep_strsplit(tokenline, ",", -1); |
| 2005 | | | for (i = 0; tokens[i] != NULL; i++) |
Event 3:
Continuing from loop body. Entering loop body. tokens[i] != (void *)0 evaluates to true.
hide
|
|
| 2006 | | | { |
| 2007 | | | hf_uint = -1; |
| 2008 | | | hf_string = -1; |
| 2009 | | | |
| 2010 | | | tokenlen = (int)strlen(tokens[i]); |
| 2011 | [+] | | typval = ep_strsplit(tokens[i], ":", 2); |
 |
| 2012 | | | if ((typval[0] != NULL) && (typval[1] != NULL)) |
Null Pointer Dereference
typval is dereferenced here, but it is NULL. The issue can occur if the highlighted code executes. See related event 6. Show: All events | Only primary events |
|
| 2013 | | | { |
| 2014 | | | if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "p"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2015 | | | { |
| 2016 | | | hf_uint = hf_mgcp_param_localconnoptions_p; |
| 2017 | | | } |
| 2018 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "a"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2019 | | | { |
| 2020 | | | hf_string = hf_mgcp_param_localconnoptions_a; |
| 2021 | | | } |
| 2022 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "s"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2023 | | | { |
| 2024 | | | hf_string = hf_mgcp_param_localconnoptions_s; |
| 2025 | | | } |
| 2026 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "e"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2027 | | | { |
| 2028 | | | hf_string = hf_mgcp_param_localconnoptions_e; |
| 2029 | | | } |
| 2030 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "sc-rtp"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2031 | | | { |
| 2032 | | | hf_string = hf_mgcp_param_localconnoptions_scrtp; |
| 2033 | | | } |
| 2034 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "sc-rtcp"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2035 | | | { |
| 2036 | | | hf_string = hf_mgcp_param_localconnoptions_scrtcp; |
| 2037 | | | } |
| 2038 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "b"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2039 | | | { |
| 2040 | | | hf_string = hf_mgcp_param_localconnoptions_b; |
| 2041 | | | } |
| 2042 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "es-ccd"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2043 | | | { |
| 2044 | | | hf_string = hf_mgcp_param_localconnoptions_esccd; |
| 2045 | | | } |
| 2046 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "es-cci"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2047 | | | { |
| 2048 | | | hf_string = hf_mgcp_param_localconnoptions_escci; |
| 2049 | | | } |
| 2050 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "dq-gi"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2051 | | | { |
| 2052 | | | hf_string = hf_mgcp_param_localconnoptions_dqgi; |
| 2053 | | | } |
| 2054 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "dq-rd"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2055 | | | { |
| 2056 | | | hf_string = hf_mgcp_param_localconnoptions_dqrd; |
| 2057 | | | } |
| 2058 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "dq-ri"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2059 | | | { |
| 2060 | | | hf_string = hf_mgcp_param_localconnoptions_dqri; |
| 2061 | | | } |
| 2062 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "dq-rr"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2063 | | | { |
| 2064 | | | hf_string = hf_mgcp_param_localconnoptions_dqrr; |
| 2065 | | | } |
| 2066 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "k"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2067 | | | { |
| 2068 | | | hf_string = hf_mgcp_param_localconnoptions_k; |
| 2069 | | | } |
| 2070 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "gc"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2071 | | | { |
| 2072 | | | hf_uint = hf_mgcp_param_localconnoptions_gc; |
| 2073 | | | } |
| 2074 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "fmtp"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2075 | | | { |
| 2076 | | | hf_string = hf_mgcp_param_localconnoptions_fmtp; |
| 2077 | | | } |
| 2078 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "nt"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2079 | | | { |
| 2080 | | | hf_string = hf_mgcp_param_localconnoptions_nt; |
| 2081 | | | } |
| 2082 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "o-fmtp"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2083 | | | { |
| 2084 | | | hf_string = hf_mgcp_param_localconnoptions_ofmtp; |
| 2085 | | | } |
| 2086 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "r"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2087 | | | { |
| 2088 | | | hf_string = hf_mgcp_param_localconnoptions_r; |
| 2089 | | | } |
| 2090 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "t"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2091 | | | { |
| 2092 | | | hf_string = hf_mgcp_param_localconnoptions_t; |
| 2093 | | | } |
| 2094 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "r-cnf"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2095 | | | { |
| 2096 | | | hf_string = hf_mgcp_param_localconnoptions_rcnf; |
| 2097 | | | } |
| 2098 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "r-dir"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2099 | | | { |
| 2100 | | | hf_string = hf_mgcp_param_localconnoptions_rdir; |
| 2101 | | | } |
| 2102 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "r-sh"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2103 | | | { |
| 2104 | | | hf_string = hf_mgcp_param_localconnoptions_rsh; |
| 2105 | | | } |
| 2106 | | | else |
| 2107 | | | { |
| 2108 | | | hf_uint = -1; |
| 2109 | | | hf_string = -1; |
| 2110 | | | } |
| 2111 | | | |
| 2112 | | | |
| 2113 | | | if (tree) |
| 2114 | | | { |
| 2115 | | | if (hf_uint != -1) |
| 2116 | | | { |
| 2117 | | | proto_tree_add_uint(tree, hf_uint, tvb, offset, tokenlen, atol(typval[1])); |
| 2118 | | | } |
| 2119 | | | else if (hf_string != -1) |
| 2120 | | | { |
| 2121 | | | proto_tree_add_string(tree, hf_string, tvb, offset, tokenlen, g_strstrip(typval[1]));
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 2122 | | | } |
| 2123 | | | else |
| 2124 | | | { |
| 2125 | | | proto_tree_add_text(tree, tvb, offset, tokenlen, "Unknown parameter: %s", tokens[i]); |
| 2126 | | | } |
| 2127 | | | } |
| 2128 | | | } |
| 2129 | | | else if (tree) |
| 2130 | | | { |
| 2131 | | | proto_tree_add_text(tree, tvb, offset, tokenlen, "Malformed parameter: %s", tokens[i]); |
| 2132 | | | } |
| 2133 | | | offset += tokenlen + 1; |
| |