(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smb2.c) |
| |
| 4180 | | | (tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, smb2_info_t *si) |
| 4181 | | | { |
| 4182 | | | offset_length_buffer_t tag_olb; |
| 4183 | | | offset_length_buffer_t data_olb; |
| 4184 | | | const char *tag; |
| 4185 | | | guint16 chain_offset; |
| 4186 | | | int offset=0; |
| 4187 | | | int len=-1; |
| 4188 | | | void (*dissector)(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, smb2_info_t *si); |
| 4189 | | | proto_item *sub_item=NULL; |
| 4190 | | | proto_tree *sub_tree=NULL; |
| 4191 | | | proto_item *parent_item=NULL; |
| 4192 | | | |
| 4193 | [+] | | chain_offset=tvb_get_letohl(tvb, offset); |
 |
| 4194 | | | if (chain_offset) { |
Event 1:
Skipping " if". chain_offset evaluates to false.
hide
|
|
| 4195 | | | len = chain_offset; |
| 4196 | | | } |
| 4197 | | | |
| 4198 | | | if(parent_tree){ |
Event 2:
Skipping " if". parent_tree evaluates to false.
hide
|
|
| 4199 | | | sub_item = proto_tree_add_text(parent_tree, tvb, offset, len, "Chain Element"); |
| 4200 | | | sub_tree = proto_item_add_subtree(sub_item, ett_smb2_create_chain_element); |
| 4201 | | | parent_item = proto_tree_get_parent(parent_tree); |
| 4202 | | | } |
| 4203 | | | |
| 4204 | | | |
| 4205 | | | proto_tree_add_item(sub_tree, hf_smb2_create_chain_offset, tvb, offset, 4, TRUE); |
Event 3:
!0 evaluates to true.
hide
|
|
| 4206 | | | offset += 4; |
| 4207 | | | |
| 4208 | | | |
| 4209 | | | offset = dissect_smb2_olb_length_offset(tvb, offset, &tag_olb, OLB_O_UINT16_S_UINT32, hf_smb2_tag); |
| 4210 | | | |
| 4211 | | | |
| 4212 | | | offset = dissect_smb2_olb_length_offset(tvb, offset, &data_olb, OLB_O_UINT16_S_UINT32, hf_smb2_create_chain_data); |
| 4213 | | | |
| 4214 | | | |
| 4215 | [+] | | tag = dissect_smb2_olb_string(pinfo, sub_tree, tvb, &tag_olb, OLB_TYPE_ASCII_STRING); |
 |
| 4216 | | | |
| 4217 | | | proto_item_append_text(parent_item, " %s", tag); |
| 4218 | | | proto_item_append_text(sub_item, ": %s", tag); |
| 4219 | | | |
| 4220 | | | |
| 4221 | | | dissector = NULL; |
| 4222 | | | if(!strcmp(tag, "ExtA")){ |
Event 8:
tag, which evaluates to NULL, is passed to strcmp() as the first argument. See related event 7.
hide
Null Pointer Dereference
The body of strcmp() dereferences tag, but it is NULL. The issue can occur if the highlighted code executes. See related event 8. Show: All events | Only primary events |
|
| |