(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smpp.c) |
| |
| 2253 | | | dissect_smpp_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) |
| 2254 | | | { |
| 2255 | | | int offset = 0; |
| 2256 | | | guint command_length; |
| 2257 | | | guint command_id; |
| 2258 | | | guint command_status; |
| 2259 | | | guint sequence_number; |
| 2260 | | | smpp_tap_rec_t* tap_rec; |
| 2261 | | | const gchar *command_str; |
| 2262 | | | const gchar *command_status_str = NULL; |
| 2263 | | | |
| 2264 | | | proto_item *ti = NULL; |
| 2265 | | | proto_tree *smpp_tree = NULL; |
| 2266 | | | |
| 2267 | | | |
| 2268 | | | |
| 2269 | | | |
| 2270 | | | |
| 2271 | | | if (tvb_reported_length(tvb) < SMPP_MIN_LENGTH) |
| 2272 | | | return; |
| 2273 | | | command_length = tvb_get_ntohl(tvb, offset); |
| 2274 | | | offset += 4; |
| 2275 | | | command_id = tvb_get_ntohl(tvb, offset); |
| 2276 | | | command_str = val_to_str(command_id, vals_command_id, |
| 2277 | | | "(Unknown SMPP Operation 0x%08X)"); |
| 2278 | | | offset += 4; |
| 2279 | | | command_status = tvb_get_ntohl(tvb, offset); |
| 2280 | | | if (command_id & 0x80000000) { |
| 2281 | | | command_status_str = val_to_str(command_status, vals_command_status, |
| 2282 | | | "(Reserved Error 0x%08X)"); |
Ignored Return Value
The return value of val_to_str() is never checked in the highlighted execution scenario. - If the return value can indicate an error, the error will be ignored if the highlighted code executes.
- The return value of val_to_str() is checked 98% of the time in this project. CodeSonar is configured to enforce Ignored Return Value checks for any function whose return value is checked at least 96% of the time, unless the function is used fewer than 20 times. (To modify these thresholds, use configuration file parameters RETURN_CHECKER_SAMPLE_SIZE and RETURN_CHECKER_RATIO. To exempt val_to_str() from the Ignored Return Value check, use configuration file parameter RETURN_CHECKER_IGNORED_FUNCS).
Show: All events | Only primary events |
|
| 2283 | | | } |
| 2284 | | | offset += 4; |
| 2285 | | | sequence_number = tvb_get_ntohl(tvb, offset); |
| 2286 | | | offset += 4; |
| 2287 | | | |
| 2288 | | | |
| 2289 | | | |
| 2290 | | | |
| 2291 | | | if (first == TRUE) { |
Event 2:
Skipping " if". !0 evaluates to true.
hide
Event 3:
Skipping " if". first == !0 evaluates to false.
hide
|
|
| 2292 | | | if (check_col(pinfo->cinfo, COL_PROTOCOL)) |
| 2293 | | | col_set_str(pinfo->cinfo, COL_PROTOCOL, "SMPP"); |
| 2294 | | | } |
| 2295 | | | |
| 2296 | | | |
| 2297 | | | |
| 2298 | | | |
| 2299 | | | if (tree) { |
Event 4:
Taking true branch. tree evaluates to true.
hide
|
|
| 2300 | | | ti = proto_tree_add_item (tree, proto_smpp, tvb, 0, tvb->length, FALSE); |
| 2301 | | | smpp_tree = proto_item_add_subtree (ti, ett_smpp); |
| 2302 | | | } |
| 2303 | | | |
| 2304 | | | |
| 2305 | | | |
| 2306 | | | |
| 2307 | | | { |
| 2308 | | | tvbuff_t *pdu_tvb; |
| 2309 | | | |
| 2310 | | | |
| 2311 | | | |
| 2312 | | | |
| 2313 | | | if (check_col(pinfo->cinfo, COL_INFO)) { |
Event 5:
Taking true branch. check_col(...) evaluates to true.
hide
|
|
| 2314 | | | if (first == TRUE) { |
Event 6:
Skipping " if". !0 evaluates to true.
hide
Event 7:
Taking false branch. first == !0 evaluates to false.
hide
|
|
| 2315 | | | |
| 2316 | | | |
| 2317 | | | |
| 2318 | | | col_clear(pinfo->cinfo, COL_INFO); |
| 2319 | | | col_add_fstr(pinfo->cinfo, COL_INFO, "SMPP %s", command_str); |
| 2320 | | | first = FALSE; |
| 2321 | | | } else { |
| 2322 | | | |
| 2323 | | | |
| 2324 | | | |
| 2325 | | | col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", command_str); |
| 2326 | | | } |
| 2327 | | | |
| 2328 | | | |
| 2329 | | | |
| 2330 | | | if (command_id & 0x80000000) { |
Event 8:
Skipping " if". command_id & 2147483648 evaluates to false.
hide
|
|
| 2331 | | | col_append_fstr(pinfo->cinfo, COL_INFO, ": \"%s\"", |
| 2332 | | | command_status_str); |
| 2333 | | | } |
| 2334 | | | } |
| 2335 | | | |
| 2336 | | | |
| 2337 | | | |
| 2338 | | | |
| 2339 | | | |
| 2340 | | | |
| 2341 | | | if (tvb_length_remaining(tvb, offset - 16 + command_length) > 0) { |
Event 9:
Taking false branch. tvb_length_remaining(...) > 0 evaluates to false.
hide
|
|
| 2342 | | | pdu_tvb = tvb_new_subset(tvb, offset - 16, |
| 2343 | | | command_length, |
| 2344 | | | command_length); |
| 2345 | | | } else { |
| 2346 | | | pdu_tvb = tvb_new_subset(tvb, offset - 16, |
| 2347 | | | tvb_length_remaining(tvb, offset - 16), |
| 2348 | | | command_length); |
| 2349 | | | } |
| 2350 | | | |
| 2351 | | | |
| 2352 | | | |
| 2353 | | | |
| 2354 | | | |
| 2355 | | | |
| 2356 | | | |
| 2357 | | | |
| 2358 | | | |
| 2359 | | | |
| 2360 | | | |
| 2361 | | | |
| 2362 | | | |
| 2363 | | | if (tree || (command_id == 4)) |
Event 10:
Taking true branch. tree evaluates to true.
hide
|
|
| 2364 | | | { |
| 2365 | | | |
| 2366 | | | |
| 2367 | | | |
| 2368 | | | if (tree) { |
Event 11:
Taking true branch. tree evaluates to true.
hide
|
|
| 2369 | | | proto_tree_add_uint(smpp_tree, hf_smpp_command_length, |
| 2370 | | | pdu_tvb, 0, 4, command_length); |
| 2371 | | | proto_tree_add_uint(smpp_tree, hf_smpp_command_id, |
| 2372 | | | pdu_tvb, 4, 4, command_id); |
| 2373 | | | proto_item_append_text(ti, ", Command: %s", command_str); |
| 2374 | | | |
| 2375 | | | |
| 2376 | | | |
| 2377 | | | |
| 2378 | | | if (command_id & 0x80000000) { |
Event 12:
Skipping " if". command_id & 2147483648 evaluates to false.
hide
|
|
| 2379 | | | proto_tree_add_uint(smpp_tree, hf_smpp_command_status, |
| 2380 | | | pdu_tvb, 8, 4, command_status); |
| 2381 | | | proto_item_append_text (ti, ", Status: \"%s\"", |
| 2382 | | | command_status_str); |
| 2383 | | | } |
| 2384 | | | proto_tree_add_uint(smpp_tree, hf_smpp_sequence_number, |
| 2385 | | | pdu_tvb, 12, 4, sequence_number); |
| 2386 | | | proto_item_append_text(ti, ", Seq: %u, Len: %u", |
| 2387 | | | sequence_number, command_length); |
| 2388 | | | } |
| 2389 | | | |
| 2390 | | | |
| 2391 | | | |
| 2392 | | | |
| 2393 | | | |
| 2394 | | | |
| 2395 | | | |
| 2396 | | | if (command_length <= tvb_reported_length(pdu_tvb)) |
Event 13:
Taking true branch. command_length <= tvb_reported_length(...) evaluates to true.
hide
|
|
| 2397 | | | { |
| 2398 | | | tvbuff_t *tmp_tvb = tvb_new_subset(pdu_tvb, 16, |
| 2399 | | | -1, command_length - 16); |
| 2400 | | | if (command_id & 0x80000000) |
Event 14:
Taking false branch. command_id & 2147483648 evaluates to false.
hide
|
|
| 2401 | | | { |
| 2402 | | | switch (command_id & 0x7FFFFFFF) { |
| 2403 | | | |
| 2404 | | | |
| 2405 | | | |
| 2406 | | | case 0: |
| 2407 | | | case 6: |
| 2408 | | | case 7: |
| 2409 | | | case 8: |
| 2410 | | | case 21: |
| 2411 | | | case 275: |
| 2412 | | | break; |
| 2413 | | | |
| 2414 | | | |
| 2415 | | | |
| 2416 | | | |
| 2417 | | | |
| 2418 | | | |
| 2419 | | | case 1: |
| 2420 | | | if (!command_status) |
| 2421 | | | bind_receiver_resp(smpp_tree, tmp_tvb); |
| 2422 | | | break; |
| 2423 | | | case 2: |
| 2424 | | | if (!command_status) |
| 2425 | | | bind_transmitter_resp(smpp_tree, tmp_tvb); |
| 2426 | | | break; |
| 2427 | | | case 3: |
| 2428 | | | if (!command_status) |
| 2429 | | | query_sm_resp(smpp_tree, tmp_tvb); |
| 2430 | | | break; |
| 2431 | | | case 4: |
| 2432 | | | if (!command_status) |
| 2433 | | | submit_sm_resp(smpp_tree, tmp_tvb); |
| 2434 | | | break; |
| 2435 | | | case 5: |
| 2436 | | | if (!command_status) |
| 2437 | | | deliver_sm_resp(smpp_tree, tmp_tvb); |
| 2438 | | | break; |
| 2439 | | | case 9: |
| 2440 | | | if (!command_status) |
| 2441 | | | bind_transceiver_resp(smpp_tree, tmp_tvb); |
| 2442 | | | break; |
| 2443 | | | case 33: |
| 2444 | | | if (!command_status) |
| 2445 | | | submit_multi_resp(smpp_tree, tmp_tvb); |
| 2446 | | | break; |
| 2447 | | | case 259: |
| 2448 | | | if (!command_status) |
| 2449 | | | data_sm_resp(smpp_tree, tmp_tvb); |
| 2450 | | | break; |
| 2451 | | | case 273: |
| 2452 | | | if (!command_status) |
| 2453 | | | broadcast_sm_resp(smpp_tree, tmp_tvb); |
| 2454 | | | break; |
| 2455 | | | case 274: |
| 2456 | | | if (!command_status) |
| 2457 | | | query_broadcast_sm_resp(smpp_tree, tmp_tvb); |
| 2458 | | | break; |
| 2459 | | | default: |
| 2460 | | | break; |
| 2461 | | | } |
| 2462 | | | } |
| 2463 | | | else |
| 2464 | | | { |
| 2465 | | | switch (command_id) { |
Event 15:
command_id evaluates to 1.
hide
|
|
| 2466 | | | case 1: |
| 2467 | | | bind_receiver(smpp_tree, tmp_tvb); |
| 2468 | | | break; |
| 2469 | | | case 2: |
| 2470 | | | bind_transmitter(smpp_tree, tmp_tvb); |
| 2471 | | | break; |
| 2472 | | | case 3: |
| 2473 | | | query_sm(smpp_tree, tmp_tvb); |
| 2474 | | | break; |
| 2475 | | | case 4: |
| 2476 | | | submit_sm(smpp_tree, tmp_tvb, pinfo, tree); |
| 2477 | | | break; |
| 2478 | | | case 5: |
| 2479 | | | deliver_sm(smpp_tree, tmp_tvb, pinfo, tree); |
| 2480 | | | break; |
| 2481 | | | case 6: |
| 2482 | | | case 21: |
| 2483 | | | break; |
| 2484 | | | case 7: |
| 2485 | | | replace_sm(smpp_tree, tmp_tvb); |
| 2486 | | | break; |
| 2487 | | | case 8: |
| 2488 | | | cancel_sm(smpp_tree, tmp_tvb); |
| 2489 | | | break; |
| 2490 | | | case 9: |
| 2491 | | | bind_transceiver(smpp_tree, tmp_tvb); |
| 2492 | | | break; |
| 2493 | | | case 11: |
| 2494 | | | outbind(smpp_tree, tmp_tvb); |
| 2495 | | | break; |
| 2496 | | | case 33: |
| 2497 | | | submit_multi(smpp_tree, tmp_tvb); |
| 2498 | | | break; |
| 2499 | | | case 258: |
| 2500 | | | alert_notification(smpp_tree, tmp_tvb); |
| 2501 | | | break; |
| 2502 | | | case 259: |
| 2503 | | | data_sm(smpp_tree, tmp_tvb); |
| 2504 | | | break; |
| 2505 | | | case 273: |
| 2506 | | | broadcast_sm(smpp_tree, tmp_tvb); |
| 2507 | | | break; |
| 2508 | | | case 274: |
| 2509 | | | query_broadcast_sm(smpp_tree, tmp_tvb); |
| 2510 | | | break; |
| 2511 | | | case 275: |
| 2512 | | | cancel_broadcast_sm(smpp_tree, tmp_tvb); |
| 2513 | | | break; |
| 2514 | | | default: |
| 2515 | | | break; |
| 2516 | | | } |
| 2517 | | | } |
| 2518 | | | |
| 2519 | | | } |
| 2520 | | | offset += command_length; |
| 2521 | | | } |
| 2522 | | | |
| 2523 | | | |
| 2524 | | | tap_rec = ep_alloc0(sizeof(smpp_tap_rec_t)); |
| 2525 | | | tap_rec->command_id = command_id; |
| 2526 | | | tap_rec->command_status = command_status; |
| 2527 | | | tap_queue_packet(smpp_tap, pinfo, tap_rec); |
| 2528 | | | |
| 2529 | | | first = FALSE; |
| 2530 | | | } |
| 2531 | | | |
| 2532 | | | return; |
| 2533 | | | } |
| |