(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-rpc.c) |
| |
| 2883 | | | dissect_rpc_fragment(tvbuff_t *tvb, int offset, packet_info *pinfo, |
| 2884 | | | proto_tree *tree, rec_dissector_t dissector, gboolean is_heur, |
| 2885 | | | int proto, int ett, gboolean defragment, gboolean first_pdu) |
| 2886 | | | { |
| 2887 | | | struct tcpinfo *tcpinfo; |
| 2888 | | | guint32 seq; |
| 2889 | | | guint32 rpc_rm; |
| 2890 | | | volatile guint32 len; |
| 2891 | | | gint32 seglen; |
| 2892 | | | gint tvb_len, tvb_reported_len; |
| 2893 | | | tvbuff_t *frag_tvb; |
| 2894 | | | gboolean rpc_succeeded; |
| 2895 | | | gboolean save_fragmented; |
| 2896 | | | rpc_fragment_key old_rfk, *rfk, *new_rfk; |
| 2897 | | | conversation_t *conversation; |
| 2898 | | | fragment_data *ipfd_head; |
| 2899 | | | tvbuff_t *rec_tvb; |
| 2900 | | | |
| 2901 | | | if (pinfo == NULL || pinfo->private_data == NULL) { |
| 2902 | | | return 0; |
| 2903 | | | } |
| 2904 | | | tcpinfo = pinfo->private_data; |
| 2905 | | | |
| 2906 | | | if (tcpinfo == NULL) { |
| 2907 | | | return 0; |
Unreachable Data Flow
The highlighted code will not execute under any circumstances. This may be because of: |
|
| 2908 | | | } |
| 2909 | | | seq = tcpinfo->seq + offset; |
| 2910 | | | |
| 2911 | | | |
| 2912 | | | |
| 2913 | | | |
| 2914 | | | if (!tvb_bytes_exist(tvb, offset, 4)) { |
| 2915 | | | |
| 2916 | | | |
| 2917 | | | |
| 2918 | | | |
| 2919 | | | return 0; |
| 2920 | | | } |
| 2921 | | | rpc_rm = tvb_get_ntohl(tvb, offset); |
| 2922 | | | |
| 2923 | | | len = rpc_rm & RPC_RM_FRAGLEN; |
| 2924 | | | |
| 2925 | | | |
| 2926 | | | |
| 2927 | | | |
| 2928 | | | |
| 2929 | | | |
| 2930 | | | |
| 2931 | | | |
| 2932 | | | |
| 2933 | | | |
| 2934 | | | if (len > max_rpc_tcp_pdu_size) |
| 2935 | | | return 0; |
| 2936 | | | if (rpc_desegment) { |
| 2937 | | | seglen = tvb_length_remaining(tvb, offset + 4); |
| 2938 | | | |
| 2939 | | | if ((gint)len > seglen && pinfo->can_desegment) { |
| 2940 | | | |
| 2941 | | | |
| 2942 | | | |
| 2943 | | | |
| 2944 | | | |
| 2945 | | | |
| 2946 | | | |
| 2947 | | | |
| 2948 | | | |
| 2949 | | | |
| 2950 | | | |
| 2951 | | | |
| 2952 | | | |
| 2953 | | | |
| 2954 | | | |
| 2955 | | | |
| 2956 | | | |
| 2957 | | | |
| 2958 | | | |
| 2959 | | | |
| 2960 | | | |
| 2961 | | | |
| 2962 | | | |
| 2963 | | | |
| 2964 | | | |
| 2965 | | | |
| 2966 | | | if (is_heur) |
| 2967 | | | return 0; |
| 2968 | | | else { |
| 2969 | | | pinfo->desegment_offset = offset; |
| 2970 | | | pinfo->desegment_len = len - seglen; |
| 2971 | | | return -((gint32) pinfo->desegment_len); |
| 2972 | | | } |
| 2973 | | | } |
| 2974 | | | } |
| 2975 | | | len += 4; |
| 2976 | | | tvb_len = tvb_length_remaining(tvb, offset); |
| 2977 | | | tvb_reported_len = tvb_reported_length_remaining(tvb, offset); |
| 2978 | | | if (tvb_len > (gint)len) |
| 2979 | | | tvb_len = len; |
| 2980 | | | if (tvb_reported_len > (gint)len) |
| 2981 | | | tvb_reported_len = len; |
| 2982 | | | frag_tvb = tvb_new_subset(tvb, offset, tvb_len, |
| 2983 | | | tvb_reported_len); |
| 2984 | | | |
| 2985 | | | |
| 2986 | | | |
| 2987 | | | |
| 2988 | | | |
| 2989 | | | if (!defragment) { |
| 2990 | | | |
| 2991 | | | |
| 2992 | | | |
| 2993 | | | |
| 2994 | | | |
| 2995 | | | |
| 2996 | | | rec_tvb = frag_tvb; |
| 2997 | | | ipfd_head = NULL; |
| 2998 | | | |
| 2999 | | | |
| 3000 | | | |
| 3001 | | | |
| 3002 | | | |
| 3003 | | | save_fragmented = pinfo->fragmented; |
| 3004 | | | pinfo->fragmented = TRUE; |
| 3005 | | | rpc_succeeded = call_message_dissector(tvb, rec_tvb, pinfo, |
| 3006 | | | tree, frag_tvb, dissector, ipfd_head, rpc_rm, first_pdu); |
| 3007 | | | pinfo->fragmented = save_fragmented; |
| 3008 | | | if (!rpc_succeeded) |
| 3009 | | | return 0; |
| 3010 | | | return len; |
| 3011 | | | } |
| 3012 | | | |
| 3013 | | | |
| 3014 | | | |
| 3015 | | | |
| 3016 | | | |
| 3017 | | | |
| 3018 | | | |
| 3019 | | | |
| 3020 | | | |
| 3021 | | | |
| 3022 | | | |
| 3023 | | | conversation = find_conversation(pinfo->fd->num, &pinfo->src, &pinfo->dst, |
| 3024 | | | pinfo->ptype, pinfo->srcport, pinfo->destport, 0); |
| 3025 | | | if (conversation == NULL) { |
| 3026 | | | |
| 3027 | | | |
| 3028 | | | |
| 3029 | | | conversation = conversation_new(pinfo->fd->num, &pinfo->src, &pinfo->dst, |
| 3030 | | | pinfo->ptype, pinfo->srcport, pinfo->destport, 0); |
| 3031 | | | } |
| 3032 | | | old_rfk.conv_id = conversation->index; |
| 3033 | | | old_rfk.seq = seq; |
| 3034 | | | old_rfk.port = pinfo->srcport; |
| 3035 | | | rfk = g_hash_table_lookup(rpc_reassembly_table, &old_rfk); |
| 3036 | | | |
| 3037 | | | if (rfk == NULL) { |
| 3038 | | | |
| 3039 | | | |
| 3040 | | | |
| 3041 | | | |
| 3042 | | | |
| 3043 | | | if (!(rpc_rm & RPC_RM_LASTFRAG)) { |
| 3044 | | | |
| 3045 | | | |
| 3046 | | | |
| 3047 | | | |
| 3048 | | | |
| 3049 | | | |
| 3050 | | | |
| 3051 | | | |
| 3052 | | | |
| 3053 | | | |
| 3054 | | | |
| 3055 | | | |
| 3056 | | | |
| 3057 | | | |
| 3058 | | | |
| 3059 | | | |
| 3060 | | | if (!(*dissector)(frag_tvb, pinfo, tree, frag_tvb, |
| 3061 | | | NULL, TRUE, rpc_rm, first_pdu)) |
| 3062 | | | return 0; |
| 3063 | | | |
| 3064 | | | |
| 3065 | | | |
| 3066 | | | |
| 3067 | | | |
| 3068 | | | |
| 3069 | | | |
| 3070 | | | |
| 3071 | | | |
| 3072 | | | rfk = se_alloc(sizeof(rpc_fragment_key)); |
| 3073 | | | rfk->conv_id = conversation->index; |
| 3074 | | | rfk->seq = seq; |
| 3075 | | | rfk->port = pinfo->srcport; |
| 3076 | | | rfk->offset = 0; |
| 3077 | | | rfk->start_seq = seq; |
| 3078 | | | g_hash_table_insert(rpc_reassembly_table, rfk, rfk); |
| 3079 | | | |
| 3080 | | | |
| 3081 | | | |
| 3082 | | | |
| 3083 | | | ipfd_head = fragment_add_multiple_ok(tvb, offset + 4, |
| 3084 | | | pinfo, rfk->start_seq, rpc_fragment_table, |
| 3085 | | | rfk->offset, len - 4, TRUE); |
| 3086 | | | |
| 3087 | | | |
| 3088 | | | |
| 3089 | | | |
| 3090 | | | |
| 3091 | | | |
| 3092 | | | |
| 3093 | | | if (ipfd_head == NULL) { |
| 3094 | | | new_rfk = se_alloc(sizeof(rpc_fragment_key)); |
| 3095 | | | new_rfk->conv_id = rfk->conv_id; |
| 3096 | | | new_rfk->seq = seq + len; |
| 3097 | | | new_rfk->port = pinfo->srcport; |
| 3098 | | | new_rfk->offset = rfk->offset + len - 4; |
| 3099 | | | new_rfk->start_seq = rfk->start_seq; |
| 3100 | | | g_hash_table_insert(rpc_reassembly_table, new_rfk, |
| 3101 | | | new_rfk); |
| 3102 | | | |
| 3103 | | | |
| 3104 | | | |
| 3105 | | | |
| 3106 | | | |
| 3107 | | | |
| 3108 | | | |
| 3109 | | | make_frag_tree(frag_tvb, tree, proto, ett,rpc_rm); |
| 3110 | | | |
| 3111 | | | |
| 3112 | | | |
| 3113 | | | |
| 3114 | | | |
| 3115 | | | return len; |
| 3116 | | | } else { |
| 3117 | | | |
| 3118 | | | |
| 3119 | | | |
| 3120 | | | |
| 3121 | | | |
| 3122 | | | |
| 3123 | | | } |
| 3124 | | | } |
| 3125 | | | |
| 3126 | | | |
| 3127 | | | |
| 3128 | | | |
| 3129 | | | |
| 3130 | | | |
| 3131 | | | |
| 3132 | | | rec_tvb = frag_tvb; |
| 3133 | | | ipfd_head = NULL; |
| 3134 | | | } else { |
| 3135 | | | |
| 3136 | | | |
| 3137 | | | |
| 3138 | | | |
| 3139 | | | |
| 3140 | | | ipfd_head = fragment_add_multiple_ok(tvb, offset + 4, pinfo, |
| 3141 | | | rfk->start_seq, rpc_fragment_table, |
| 3142 | | | rfk->offset, len - 4, !(rpc_rm & RPC_RM_LASTFRAG)); |
| 3143 | | | |
| 3144 | | | if (ipfd_head == NULL) { |
| 3145 | | | |
| 3146 | | | |
| 3147 | | | |
| 3148 | | | |
| 3149 | | | |
| 3150 | | | |
| 3151 | | | |
| 3152 | | | |
| 3153 | | | |
| 3154 | | | |
| 3155 | | | |
| 3156 | | | |
| 3157 | | | |
| 3158 | | | |
| 3159 | | | |
| 3160 | | | new_rfk = se_alloc(sizeof(rpc_fragment_key)); |
| 3161 | | | new_rfk->conv_id = rfk->conv_id; |
| 3162 | | | new_rfk->seq = seq + len; |
| 3163 | | | new_rfk->port = pinfo->srcport; |
| 3164 | | | new_rfk->offset = rfk->offset + len - 4; |
| 3165 | | | new_rfk->start_seq = rfk->start_seq; |
| 3166 | | | g_hash_table_insert(rpc_reassembly_table, new_rfk, |
| 3167 | | | new_rfk); |
| 3168 | | | |
| 3169 | | | |
| 3170 | | | |
| 3171 | | | |
| 3172 | | | |
| 3173 | | | |
| 3174 | | | |
| 3175 | | | |
| 3176 | | | make_frag_tree(frag_tvb, tree, proto, ett, rpc_rm); |
| 3177 | | | |
| 3178 | | | |
| 3179 | | | |
| 3180 | | | |
| 3181 | | | |
| 3182 | | | return len; |
| 3183 | | | } |
| 3184 | | | |
| 3185 | | | |
| 3186 | | | |
| 3187 | | | |
| 3188 | | | |
| 3189 | | | |
| 3190 | | | |
| 3191 | | | |
| 3192 | | | |
| 3193 | | | if (!(rpc_rm & RPC_RM_LASTFRAG)) { |
| 3194 | | | |
| 3195 | | | |
| 3196 | | | |
| 3197 | | | |
| 3198 | | | |
| 3199 | | | |
| 3200 | | | |
| 3201 | | | |
| 3202 | | | |
| 3203 | | | |
| 3204 | | | |
| 3205 | | | |
| 3206 | | | make_frag_tree(frag_tvb, tree, proto, ett, rpc_rm); |
| 3207 | | | |
| 3208 | | | |
| 3209 | | | |
| 3210 | | | |
| 3211 | | | |
| 3212 | | | |
| 3213 | | | return len; |
| 3214 | | | } |
| 3215 | | | |
| 3216 | | | |
| 3217 | | | |
| 3218 | | | |
| 3219 | | | |
| 3220 | | | |
| 3221 | | | |
| 3222 | | | |
| 3223 | | | |
| 3224 | | | |
| 3225 | | | |
| 3226 | | | rec_tvb = tvb_new_real_data(ipfd_head->data, |
| 3227 | | | ipfd_head->datalen, ipfd_head->datalen); |
| 3228 | | | |
| 3229 | | | |
| 3230 | | | |
| 3231 | | | |
| 3232 | | | |
| 3233 | | | tvb_set_child_real_data_tvbuff(tvb, rec_tvb); |
| 3234 | | | |
| 3235 | | | |
| 3236 | | | |
| 3237 | | | |
| 3238 | | | add_new_data_source(pinfo, rec_tvb, "Defragmented"); |
| 3239 | | | } |
| 3240 | | | |
| 3241 | | | |
| 3242 | | | |
| 3243 | | | |
| 3244 | | | |
| 3245 | | | if (!call_message_dissector(tvb, rec_tvb, pinfo, tree, |
| 3246 | | | frag_tvb, dissector, ipfd_head, rpc_rm, first_pdu)) |
| 3247 | | | return 0; |
| 3248 | | | return len; |
| 3249 | | | } |
| |