(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-text-media.c) |
| |
| 60 | | | dissect_text_lines(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) |
| 61 | | | { |
| 62 | | | proto_tree *subtree; |
| 63 | | | proto_item *ti; |
| 64 | | | gint offset = 0, next_offset; |
| 65 | | | gint len; |
| 66 | | | const char *data_name; |
| 67 | | | |
| 68 | | | data_name = pinfo->match_string; |
| 69 | | | if (! (data_name && data_name[0])) { |
Event 1:
Skipping " if". - data_name evaluates to true.
- data_name[0] evaluates to true.
hide
|
|
| 70 | | | |
| 71 | | | |
| 72 | | | |
| 73 | | | data_name = (char *)(pinfo->private_data); |
| 74 | | | if (! (data_name && data_name[0])) { |
| 75 | | | |
| 76 | | | |
| 77 | | | |
| 78 | | | data_name = NULL; |
| 79 | | | } |
| 80 | | | } |
| 81 | | | |
| 82 | | | if (data_name && check_col(pinfo->cinfo, COL_INFO)) |
Null Test After Dereference
This code tests the nullness of data_name, which has already been dereferenced. - If data_name were null, there would have been a prior null pointer dereference at packet-text-media.c:69, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 2. Show: All events | Only primary events |
|
| 83 | | | col_append_sep_fstr(pinfo->cinfo, COL_INFO, " ", "(%s)", |
| 84 | | | data_name); |
| 85 | | | |
| 86 | | | if (tree) { |
| 87 | | | ti = proto_tree_add_item(tree, proto_text_lines, |
| 88 | | | tvb, 0, -1, FALSE); |
| 89 | | | if (data_name) |
| 90 | | | proto_item_append_text(ti, ": %s", data_name); |
| 91 | | | subtree = proto_item_add_subtree(ti, ett_text_lines); |
| 92 | | | |
| 93 | | | while (tvb_reported_length_remaining(tvb, offset) != 0) { |
| 94 | | | |
| 95 | | | |
| 96 | | | |
| 97 | | | |
| 98 | | | |
| 99 | | | |
| 100 | | | |
| 101 | | | |
| 102 | | | |
| 103 | | | len = tvb_find_line_end(tvb, offset, |
| 104 | | | tvb_ensure_length_remaining(tvb, offset), |
| 105 | | | &next_offset, FALSE); |
| 106 | | | if (len == -1) |
| 107 | | | break; |
| 108 | | | |
| 109 | | | |
| 110 | | | |
| 111 | | | |
| 112 | | | |
| 113 | | | proto_tree_add_text(subtree, tvb, offset, next_offset - offset, |
| 114 | | | "%s", tvb_format_text(tvb, offset, |
| 115 | | | next_offset - offset)); |
| 116 | | | offset = next_offset; |
| 117 | | | } |
| 118 | | | } |
| 119 | | | } |
| |