(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-scsi.c) |
| |
| 4618 | | | dissect_scsi_cdb (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, |
| 4619 | | | gint devtype_arg, itlq_nexus_t *itlq, itl_nexus_t *itl) |
| 4620 | | | { |
| 4621 | | | int offset = 0; |
| 4622 | | | proto_item *ti; |
| 4623 | | | proto_tree *scsi_tree = NULL; |
| 4624 | | | guint8 opcode; |
| 4625 | | | scsi_device_type devtype; |
| 4626 | | | const gchar *valstr; |
| 4627 | | | scsi_task_data_t *cdata; |
| 4628 | | | const char *old_proto; |
| 4629 | | | cmdset_t *csdata; |
| 4630 | | | |
| 4631 | | | |
| 4632 | | | old_proto=pinfo->current_proto; |
| 4633 | | | pinfo->current_proto="SCSI"; |
| 4634 | | | |
| 4635 | | | if(!itlq){ |
Event 1:
Skipping " if". itlq evaluates to true.
hide
|
|
| 4636 | | | DISSECTOR_ASSERT_NOT_REACHED();
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
131 | #define DISSECTOR_ASSERT_NOT_REACHED() \ |
132 | (REPORT_DISSECTOR_BUG( \ |
133 | ep_strdup_printf("%s:%u: failed assertion \"DISSECTOR_ASSERT_NOT_REACHED\"", \ |
134 | __FILE__, __LINE__))) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
106 | #define REPORT_DISSECTOR_BUG(message) \ |
107 | ((getenv("WIRESHARK_ABORT_ON_DISSECTOR_BUG") != NULL) ? \ |
108 | abort() : \ |
109 | THROW_MESSAGE(DissectorError, message)) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/exceptions.h |
| |
226 | #define THROW_MESSAGE(x, y) \ |
227 | except_throw(XCEPT_GROUP_WIRESHARK, (x), (y)) |
| |
|
| 4637 | | | } |
| 4638 | | | if(!itl){ |
Event 2:
Skipping " if". itl evaluates to true.
hide
|
|
| 4639 | | | DISSECTOR_ASSERT_NOT_REACHED();
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
131 | #define DISSECTOR_ASSERT_NOT_REACHED() \ |
132 | (REPORT_DISSECTOR_BUG( \ |
133 | ep_strdup_printf("%s:%u: failed assertion \"DISSECTOR_ASSERT_NOT_REACHED\"", \ |
134 | __FILE__, __LINE__))) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
106 | #define REPORT_DISSECTOR_BUG(message) \ |
107 | ((getenv("WIRESHARK_ABORT_ON_DISSECTOR_BUG") != NULL) ? \ |
108 | abort() : \ |
109 | THROW_MESSAGE(DissectorError, message)) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/exceptions.h |
| |
226 | #define THROW_MESSAGE(x, y) \ |
227 | except_throw(XCEPT_GROUP_WIRESHARK, (x), (y)) |
| |
|
| 4640 | | | } |
| 4641 | | | |
| 4642 | | | opcode = tvb_get_guint8 (tvb, offset); |
| 4643 | | | itlq->scsi_opcode=opcode; |
| 4644 | | | csdata=get_cmdset_data(itlq, itl); |
| 4645 | | | |
| 4646 | | | if (devtype_arg != SCSI_DEV_UNKNOWN) { |
Event 3:
Taking false branch. devtype_arg != -1 evaluates to false.
hide
|
|
| 4647 | | | devtype = devtype_arg; |
| 4648 | | | } else { |
| 4649 | | | if (itl) { |
Event 4:
Taking true branch. itl evaluates to true.
hide
|
|
| 4650 | | | devtype = itl->cmdset; |
| 4651 | | | } else { |
| 4652 | | | devtype = (scsi_device_type)scsi_def_devtype; |
| 4653 | | | } |
| 4654 | | | } |
| 4655 | | | |
| 4656 | | | if ((valstr = match_strval (opcode, scsi_spc_vals)) == NULL) { |
Event 6:
Skipping " if". (valstr = match_strval(...)) == (void *)0 evaluates to false.
hide
|
|
| 4657 | | | valstr = match_strval(opcode, csdata->cdb_vals); |
| 4658 | | | } |
| 4659 | | | |
| 4660 | | | if (check_col (pinfo->cinfo, COL_INFO)) { |
Event 7:
Skipping " if". check_col(...) evaluates to false.
hide
|
|
| 4661 | | | if (valstr != NULL) { |
| 4662 | | | col_add_fstr (pinfo->cinfo, COL_INFO, "SCSI: %s LUN: 0x%02x ", valstr, itlq->lun); |
| 4663 | | | } else { |
| 4664 | | | col_add_fstr (pinfo->cinfo, COL_INFO, "SCSI Command: 0x%02x LUN:0x%02x ", opcode, itlq->lun); |
| 4665 | | | } |
| 4666 | | | |
| 4667 | | | col_set_fence(pinfo->cinfo, COL_INFO); |
| 4668 | | | } |
| 4669 | | | |
| 4670 | | | cdata = ep_alloc(sizeof(scsi_task_data_t)); |
| 4671 | | | cdata->itl=itl; |
| 4672 | | | cdata->itlq=itlq; |
| 4673 | | | cdata->type=SCSI_PDU_TYPE_CDB; |
| 4674 | | | tap_queue_packet(scsi_tap, pinfo, cdata); |
| 4675 | | | |
| 4676 | | | if (tree) { |
Event 8:
Skipping " if". tree evaluates to false.
hide
|
|
| 4677 | | | ti = proto_tree_add_protocol_format (tree, proto_scsi, tvb, 0, |
| 4678 | | | -1, "SCSI CDB %s", |
| 4679 | | | val_to_str (opcode, |
| 4680 | | | csdata->cdb_vals, |
| 4681 | | | "0x%02x") |
| 4682 | | | ); |
| 4683 | | | scsi_tree = proto_item_add_subtree (ti, ett_scsi); |
| 4684 | | | } |
| 4685 | | | |
| 4686 | | | ti=proto_tree_add_uint(scsi_tree, hf_scsi_lun, tvb, 0, 0, itlq->lun); |
| 4687 | | | PROTO_ITEM_SET_GENERATED(ti);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
325 | #define PROTO_ITEM_SET_GENERATED(proto_item) \ |
326 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_GENERATED) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
Event 9:
ti evaluates to false.
hide
|
|
| 4688 | | | |
| 4689 | | | if(itl){ |
Null Test After Dereference
This code tests the nullness of itl, which has already been dereferenced. - If itl were null, there would have been a prior null pointer dereference at packet-scsi.c:4650, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 5. Show: All events | Only primary events |
|
| 4690 | | | ti=proto_tree_add_uint_format(scsi_tree, hf_scsi_inq_devtype, tvb, 0, 0, itl->cmdset&SCSI_CMDSET_MASK, "Command Set:%s (0x%02x) %s", val_to_str(itl->cmdset&SCSI_CMDSET_MASK, scsi_devtype_val, "Unknown (%d)"), itl->cmdset&SCSI_CMDSET_MASK,itl->cmdset&SCSI_CMDSET_DEFAULT?"(Using default commandset)":""); |
| 4691 | | | PROTO_ITEM_SET_GENERATED(ti);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
325 | #define PROTO_ITEM_SET_GENERATED(proto_item) \ |
326 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_GENERATED) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
| 4692 | | | } |
| 4693 | | | |
| 4694 | | | if(itlq->last_exchange_frame){ |
| 4695 | | | ti=proto_tree_add_uint(scsi_tree, hf_scsi_response_frame, tvb, 0, 0, itlq->last_exchange_frame); |
| 4696 | | | PROTO_ITEM_SET_GENERATED(ti);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
325 | #define PROTO_ITEM_SET_GENERATED(proto_item) \ |
326 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_GENERATED) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
| 4697 | | | } |
| 4698 | | | |
| 4699 | | | |
| 4700 | | | if (valstr != NULL) { |
| 4701 | | | proto_tree_add_uint_format (scsi_tree, csdata->hf_opcode, tvb, |
| 4702 | | | offset, 1, |
| 4703 | | | tvb_get_guint8 (tvb, offset), |
| 4704 | | | "Opcode: %s (0x%02x)", valstr, |
| 4705 | | | opcode); |
| 4706 | | | } else { |
| 4707 | | | proto_tree_add_item (scsi_tree, hf_scsi_spcopcode, tvb, offset, 1, 0); |
| 4708 | | | } |
| 4709 | | | |
| 4710 | | | if(csdata->cdb_table[opcode].func){ |
| 4711 | | | csdata->cdb_table[opcode].func(tvb, pinfo, scsi_tree, offset+1, |
| 4712 | | | TRUE, TRUE, 0, cdata); |
| 4713 | | | } else if(spc[opcode].func){ |
| 4714 | | | spc[opcode].func(tvb, pinfo, scsi_tree, offset+1, |
| 4715 | | | TRUE, TRUE, 0, cdata); |
| 4716 | | | } else { |
| 4717 | | | call_dissector (data_handle, tvb, pinfo, scsi_tree); |
| 4718 | | | } |
| 4719 | | | |
| 4720 | | | pinfo->current_proto=old_proto; |
| 4721 | | | } |
| |