(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-x11.c) |
| |
| 2106 | | | static void listOfTextItem(tvbuff_t *tvb, int *offsetp, proto_tree *t, int hf, |
| 2107 | | | int sizeIs16, int next_offset, gboolean little_endian) |
| 2108 | | | { |
| 2109 | | | int allocated = 0; |
| 2110 | | | char *s = NULL; |
Event 1:
s is set to NULL. - Dereferenced later, causing the null pointer dereference.
hide
|
|
| 2111 | | | proto_item *ti; |
| 2112 | | | proto_tree *tt; |
| 2113 | | | guint32 fid; |
| 2114 | | | |
| 2115 | | | |
| 2116 | | | |
| 2117 | | | int scanning_offset = *offsetp; |
| 2118 | | | int l; |
| 2119 | | | int n = 0; |
| 2120 | | | |
| 2121 | | | while(scanning_offset < next_offset) { |
| 2122 | | | l = tvb_get_guint8(tvb, scanning_offset); |
| 2123 | | | scanning_offset++; |
| 2124 | | | if (!l) break; |
| 2125 | | | n++; |
| 2126 | | | scanning_offset += l == 255 ? 4 : l + (sizeIs16 ? l : 0) + 1; |
| 2127 | | | } |
| 2128 | | | |
| 2129 | | | ti = proto_tree_add_item(t, hf, tvb, *offsetp, scanning_offset - *offsetp, little_endian); |
| 2130 | | | tt = proto_item_add_subtree(ti, ett_x11_list_of_text_item); |
| 2131 | | | |
| 2132 | | | while(n--) { |
Event 3:
Entering loop body. n-- evaluates to true.
hide
|
|
| 2133 | [+] | | unsigned l = VALUE8(tvb, *offsetp); |
 |
| 2134 | | | if (l == 255) { |
Event 18:
Taking false branch. l == 255 evaluates to false.
hide
|
|
| 2135 | | | fid = tvb_get_ntohl(tvb, *offsetp + 1); |
| 2136 | | | proto_tree_add_uint(tt, hf_x11_textitem_font, tvb, *offsetp, 5, fid); |
| 2137 | | | *offsetp += 5; |
| 2138 | | | } else { |
| 2139 | | | proto_item *tti; |
| 2140 | | | proto_tree *ttt; |
| 2141 | | | gint8 delta = VALUE8(tvb, *offsetp + 1); |
| 2142 | | | if (sizeIs16) l += l; |
Event 19:
Skipping " if". sizeIs16 evaluates to false.
hide
|
|
| 2143 | | | if ((unsigned) allocated < l + 1) { |
Event 20:
Skipping " if". (unsigned int)allocated < l + 1 evaluates to false.
hide
|
|
| 2144 | | | s = ep_alloc(l + 1); |
| 2145 | | | allocated = l + 1; |
| 2146 | | | } |
| 2147 | [+] | | stringCopy(s, (gchar *)tvb_get_ptr(tvb, *offsetp + 2, l), l); |
Event 21:
s, which evaluates to NULL, is passed to stringCopy() as the first argument. See related event 1.
hide
|
|
 |
| |