(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/uat.c) |
| |
| 532 | | | char* uat_unesc(const char* si, guint in_len, guint* len_p) { |
| 533 | | | char* buf = g_malloc0(in_len+1); |
| 534 | | | char* p = buf; |
| 535 | | | guint len = 0; |
| 536 | | | const char* s; |
| 537 | | | const char* in_end = si+in_len; |
| 538 | | | |
| 539 | | | for (s = (void*)si; s < in_end; s++) { |
Event 3:
Continuing from loop body. Entering loop body. s < in_end evaluates to true.
hide
|
|
| 540 | | | switch(*s) { |
Event 4:
*s evaluates to 92.
hide
|
|
| 541 | | | case '\\': |
| 542 | | | switch(*(++s)) { |
Event 5:
*++s evaluates to 55.
hide
|
|
| 543 | | | case 'a': *(p++) = '\a'; len++; break; |
| 544 | | | case 'b': *(p++) = '\b'; len++; break; |
| 545 | | | case 'e': *(p++) = '\033' ; len++; break; |
| 546 | | | case 'f': *(p++) = '\f'; len++; break; |
| 547 | | | case 'n': *(p++) = '\n'; len++; break; |
| 548 | | | case 'r': *(p++) = '\r'; len++; break; |
| 549 | | | case 't': *(p++) = '\t'; len++; break; |
| 550 | | | case 'v': *(p++) = '\v'; len++; break; |
| 551 | | | |
| 552 | | | case '0': |
| 553 | | | case '1': |
| 554 | | | case '2': |
| 555 | | | case '3': |
| 556 | | | case '4': |
| 557 | | | case '5': |
| 558 | | | case '6': |
| 559 | | | case '7': |
| 560 | | | { |
| 561 | | | int c0 = 0; |
| 562 | | | int c1 = 0; |
| 563 | | | int c2 = 0; |
| 564 | | | int c = 0; |
| 565 | | | |
| 566 | | | c0 = (*s) - '0'; |
| 567 | | | |
| 568 | | | if ( s[1] >= '0' && s[1] <= '7' ) { |
| 569 | | | c1 = c0; |
| 570 | | | c0 = (*++s) - '0'; |
| 571 | | | |
| 572 | | | if ( s[1] >= '0' && s[1] <= '7' ) { |
| 573 | | | c2 = c1; |
| 574 | | | c1 = c0; |
| 575 | | | c0 = (*++s) - '0'; |
| 576 | | | } |
| 577 | | | } |
| 578 | | | c = (64 * c2) + (8 * c1) + c0; |
| 579 | | | *(p++) = (char) (c > 255 ? 255 : c); |
Event 8:
c > 255 evaluates to true.
hide
Cast Alters Value
c > 255 ? 255 : c is cast from int to char. - c > 255 ? 255 : c evaluates to 255.
- Values 128 or higher cannot be stored as char. Casting them to char can cause data loss or sign change.
The issue can occur if the highlighted code executes. Show: All events | Only primary events |
|
| 580 | | | len++; |
| 581 | | | break; |
| 582 | | | } |
| 583 | | | |
| 584 | | | case 'x': |
| 585 | | | { |
| 586 | | | char c1 = *(s+1); |
| 587 | | | char c0 = *(s+2); |
| 588 | | | |
| 589 | | | if (isxdigit((guchar)c1) && isxdigit((guchar)c0)) { |
| 590 | | | *(p++) = (xton(c1) * 0x10) + xton(c0); |
| 591 | | | s += 2; |
| 592 | | | } else { |
| 593 | | | *(p++) = *s; |
| 594 | | | } |
| 595 | | | len++; |
| 596 | | | break; |
| 597 | | | } |
| 598 | | | default: |
| 599 | | | *p++ = *s; |
| 600 | | | break; |
| 601 | | | } |
| 602 | | | break; |
| 603 | | | default: |
| 604 | | | *(p++) = *s; |
| 605 | | | len++; |
| 606 | | | break; |
| |