(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dcerpc-spoolss.c) |
| |
| 6608 | | | dissect_spoolss_printer_enum_values(tvbuff_t *tvb, int offset, |
| 6609 | | | packet_info *pinfo, proto_tree *tree, |
| 6610 | | | guint8 *drep) |
| 6611 | | | { |
| 6612 | | | guint32 start_offset = offset; |
| 6613 | | | guint32 name_offset, name_len, val_offset, val_len, val_type; |
| 6614 | | | char *name; |
| 6615 | | | proto_item *item; |
| 6616 | | | proto_tree *subtree; |
| 6617 | | | |
| 6618 | | | |
| 6619 | | | |
| 6620 | | | offset = dissect_ndr_uint32( |
| 6621 | | | tvb, offset, pinfo, NULL, drep, |
| 6622 | | | hf_enumprinterdataex_name_offset, &name_offset); |
| 6623 | | | |
| 6624 | | | offset = dissect_ndr_uint32( |
| 6625 | | | tvb, offset, pinfo, NULL, drep, |
| 6626 | | | hf_enumprinterdataex_name_len, &name_len); |
| 6627 | | | |
| 6628 | | | dissect_spoolss_uint16uni( |
| 6629 | | | tvb, start_offset + name_offset, pinfo, NULL, drep, |
| 6630 | | | &name, "Name"); |
| 6631 | | | |
| 6632 | | | item = proto_tree_add_text(tree, tvb, offset, 0, "Name: "); |
| 6633 | | | |
| 6634 | | | subtree = proto_item_add_subtree(item, ett_printer_enumdataex_value); |
| 6635 | | | |
| 6636 | | | proto_item_append_text(item, "%s", name); |
| 6637 | | | |
| 6638 | | | proto_tree_add_text( |
| 6639 | | | subtree, tvb, offset - 8, 4, "Name offset: %d", name_offset); |
| 6640 | | | |
| 6641 | | | proto_tree_add_text( |
| 6642 | | | subtree, tvb, offset - 4, 4, "Name len: %d", name_len); |
| 6643 | | | |
| 6644 | | | proto_tree_add_text( |
| 6645 | | | subtree, tvb, start_offset + name_offset, ((int)strlen(name) + 1) * 2, |
| 6646 | | | "Name: %s", name); |
| 6647 | | | |
| 6648 | | | offset = dissect_ndr_uint32( |
| 6649 | | | tvb, offset, pinfo, subtree, drep, hf_printerdata_type, |
| 6650 | | | &val_type); |
| 6651 | | | |
| 6652 | | | offset = dissect_ndr_uint32( |
| 6653 | | | tvb, offset, pinfo, subtree, drep, |
| 6654 | | | hf_enumprinterdataex_val_offset, &val_offset); |
| 6655 | | | |
| 6656 | | | offset = dissect_ndr_uint32( |
| 6657 | | | tvb, offset, pinfo, subtree, drep, |
| 6658 | | | hf_enumprinterdataex_val_len, &val_len); |
| 6659 | | | |
| 6660 | | | if (val_len == 0) { |
Event 1:
Skipping " if". val_len == 0 evaluates to false.
hide
|
|
| 6661 | | | proto_tree_add_text(subtree, tvb, start_offset + val_offset, 4, |
| 6662 | | | "Value: (null)"); |
| 6663 | | | goto done; |
| 6664 | | | } |
| 6665 | | | |
| 6666 | | | switch(val_type) { |
Event 2:
val_type evaluates to 4.
hide
|
|
| 6667 | | | case DCERPC_REG_DWORD: { |
| 6668 | | | guint32 value; |
| 6669 | | | guint16 low, high; |
| 6670 | | | int offset2 = start_offset + val_offset; |
| 6671 | | | |
| 6672 | | | |
| 6673 | | | |
| 6674 | | | |
| 6675 | | | offset2 = dissect_ndr_uint16( |
| 6676 | | | tvb, offset2, pinfo, subtree, drep, |
| 6677 | | | hf_enumprinterdataex_val_dword_low, &low); |
| 6678 | | | |
| 6679 | | | offset2 = dissect_ndr_uint16( |
| 6680 | | | tvb, offset2, pinfo, subtree, drep, |
| 6681 | [+] | | hf_enumprinterdataex_val_dword_high, &high); |
Event 3:
dissect_ndr_uint16() does not initialize high. - This may be because of a failure case or other special case for dissect_ndr_uint16().
hide
|
|
 |
| 6682 | | | |
| 6683 | | | value = (high << 16) | low; |
Uninitialized Variable
high was not initialized. The issue can occur if the highlighted code executes. See related event 3. Show: All events | Only primary events |
|
| |