(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dcom.c) |
| |
| 1144 | | | dissect_dcom_SAFEARRAY(tvbuff_t *tvb, int offset, packet_info *pinfo, |
| 1145 | | | proto_tree *tree, guint8 *drep, int hfindex _U_, sa_callback_t sacb) |
| 1146 | | | { |
| 1147 | | | guint32 u32Dims; |
| 1148 | | | guint16 u16Dims; |
| 1149 | | | guint16 u16Features; |
| 1150 | | | guint32 u32ElementSize; |
| 1151 | | | guint32 u32VarType; |
| 1152 | | | guint32 u32Elements; |
| 1153 | | | guint32 u32Pointer; |
| 1154 | | | guint32 u32BoundElements; |
| 1155 | | | guint32 u32LowBound; |
| 1156 1165 |  | | [ Lines 1156 to 1165 omitted. ] |
| 1166 | | | proto_tree *sub_tree; |
| 1167 | | | guint32 u32SubStart; |
| 1168 | | | guint32 u32TmpOffset; |
| 1169 | | | |
| 1170 | | | proto_item *feature_item; |
| 1171 | | | proto_tree *feature_tree; |
| 1172 | | | |
| 1173 | | | |
| 1174 | | | |
| 1175 | | | |
| 1176 | | | sub_item = proto_tree_add_item(tree, hf_dcom_safearray, tvb, offset, 0, FALSE); |
| 1177 | | | sub_tree = proto_item_add_subtree(sub_item, ett_dcom_safearray); |
| 1178 | | | u32SubStart = offset; |
| 1179 | | | |
| 1180 | | | offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, drep, &u32Pointer); |
| 1181 | | | offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, drep, &u32Pointer); |
| 1182 | | | |
| 1183 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1184 | [+] | | hf_dcom_sa_dims32, &u32Dims); |
 |
| 1185 | | | offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, drep, |
| 1186 | | | hf_dcom_sa_dims16, &u16Dims); |
| 1187 | | | |
| 1188 | | | |
| 1189 | | | u32TmpOffset = dissect_dcom_WORD(tvb, offset, pinfo, NULL, drep, |
| 1190 | | | hf_dcom_sa_features, &u16Features); |
| 1191 | | | feature_item = proto_tree_add_uint (sub_tree, hf_dcom_sa_features, tvb, offset, 2, u16Features); |
| 1192 | [+] | | feature_tree = proto_item_add_subtree (feature_item, ett_dcom_sa_features); |
 |
| 1193 | | | if (feature_tree) { |
Event 7:
Skipping " if". feature_tree evaluates to false.
hide
|
|
| 1194 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_variant, tvb, offset, 2, u16Features); |
| 1195 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_dispatch, tvb, offset, 2, u16Features); |
| 1196 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_unknown, tvb, offset, 2, u16Features); |
| 1197 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_bstr, tvb, offset, 2, u16Features); |
| 1198 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_have_vartype, tvb, offset, 2, u16Features); |
| 1199 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_have_iid, tvb, offset, 2, u16Features); |
| 1200 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_record, tvb, offset, 2, u16Features); |
| 1201 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_fixedsize, tvb, offset, 2, u16Features); |
| 1202 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_embedded, tvb, offset, 2, u16Features); |
| 1203 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_static, tvb, offset, 2, u16Features); |
| 1204 | | | proto_tree_add_boolean (feature_tree, hf_dcom_sa_features_auto, tvb, offset, 2, u16Features); |
| 1205 | | | } |
| 1206 | | | offset = u32TmpOffset; |
| 1207 | | | |
| 1208 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1209 | | | hf_dcom_sa_element_size, &u32ElementSize); |
| 1210 | | | offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, drep, |
| 1211 | | | hf_dcom_sa_locks, &u16Locks); |
| 1212 | | | offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, drep, |
| 1213 | | | hf_dcom_sa_vartype16, &u16VarType); |
| 1214 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1215 | | | hf_dcom_sa_vartype32, &u32VarType); |
| 1216 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1217 | | | hf_dcom_sa_elements, &u32Elements); |
| 1218 | | | offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, drep, &u32Pointer); |
| 1219 | | | |
| 1220 | | | while(u32Dims--) { |
Event 8:
Leaving loop. u32Dims-- evaluates to false.
hide
|
|
| 1221 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1222 | | | hf_dcom_sa_bound_elements, &u32BoundElements); |
| 1223 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1224 | | | hf_dcom_sa_low_bound, &u32LowBound); |
| 1225 | | | } |
| 1226 | | | |
| 1227 | | | offset = dissect_dcom_dcerpc_array_size(tvb, offset, pinfo, sub_tree, drep, &u32ArraySize); |
| 1228 | | | |
| 1229 | | | tvb_ensure_bytes_exist(tvb, offset, u32ArraySize * u32ElementSize); |
| 1230 | | | u32VariableOffset = offset + u32ArraySize * u32ElementSize; |
| 1231 | | | |
| 1232 | | | if(sacb) { |
Event 9:
Skipping " if". sacb evaluates to false.
hide
|
|
| 1233 | | | sacb(tvb, offset, pinfo, tree, drep, u32VarType, u32ArraySize); |
| 1234 | | | } |
| 1235 | | | |
| 1236 | | | u32Tmp = u32ArraySize; |
| 1237 | | | while(u32ArraySize--) { |
| 1238 | | | switch(u32VarType) { |
| 1239 | | | case(WIRESHARK_VT_ERROR): |
| 1240 | | | offset = dissect_dcom_HRESULT(tvb, offset, pinfo, sub_tree, drep, |
| 1241 | | | &u32Data); |
| 1242 | | | break; |
| 1243 | | | case(WIRESHARK_VT_I1): |
| 1244 | | | offset = dissect_dcom_BYTE(tvb, offset, pinfo, sub_tree, drep, |
| 1245 | | | hf_dcom_vt_i1, &u8Data); |
| 1246 | | | break; |
| 1247 | | | case(WIRESHARK_VT_I2): |
| 1248 | | | offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, drep, |
| 1249 | | | hf_dcom_vt_i2, &u16Data); |
| 1250 | | | break; |
| 1251 | | | case(WIRESHARK_VT_I4): |
| 1252 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1253 | | | hf_dcom_vt_i4, &u32Data); |
| 1254 | | | break; |
| 1255 | | | case(WIRESHARK_VT_I8): |
| 1256 | | | offset = dissect_dcom_I8(tvb, offset, pinfo, sub_tree, drep, |
| 1257 | | | hf_dcom_vt_i8, NULL); |
| 1258 | | | |
| 1259 | | | u32VariableOffset = offset; |
| 1260 | | | break; |
| 1261 | | | case(WIRESHARK_VT_BSTR): |
| 1262 | | | offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, drep, &u32Pointer); |
| 1263 | | | if (u32Pointer) { |
| 1264 | | | u32VariableOffset = dissect_dcom_BSTR(tvb, u32VariableOffset, pinfo, sub_tree, drep, |
| 1265 | | | hf_dcom_vt_bstr, cData, sizeof(cData) ); |
| 1266 | | | } |
| 1267 | | | break; |
| 1268 | | | default: |
| 1269 | | | |
| 1270 | | | |
| 1271 | | | |
| 1272 | | | |
| 1273 | | | |
| 1274 | | | |
| 1275 | | | |
| 1276 | | | u32VariableOffset = dissect_dcom_tobedone_data(tvb, u32VariableOffset, pinfo, sub_tree, drep, |
| 1277 | | | 10000); |
| 1278 | | | } |
| 1279 | | | } |
| 1280 | | | |
| 1281 | | | |
| 1282 | | | proto_item_append_text(sub_item, ": Elements: %u/%u VarType: %s", |
| 1283 | | | u32Elements, u32BoundElements, |
Uninitialized Variable
u32BoundElements was not initialized. The issue can occur if the highlighted code executes. Show: All events | Only primary events |
|
| 1284 | | | val_to_str(u32VarType, dcom_variant_type_vals, "Unknown (0x%08x)") ); |
| |