(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/prefs.c) |
| |
| 898 | | | static gchar * |
| 899 | | | put_string_list(GList *sl) |
| 900 | | | { |
| 901 | | | static gchar pref_str[MAX_FMT_PREF_LEN] = ""; |
| 902 | | | GList *clp = g_list_first(sl); |
| 903 | | | gchar *str; |
| 904 | | | size_t cur_pos = 0, cur_len = 0; |
Event 2:
cur_len is set to 0. - This determines the potentially dangerous position that will be accessed later.
hide
|
|
| 905 | | | gchar *quoted_str; |
| 906 | | | size_t str_len; |
| 907 | | | gchar *strp, *quoted_strp, c; |
| 908 | | | size_t fmt_len; |
| 909 | | | |
| 910 | | | while (clp) { |
Event 3:
Entering loop body. clp evaluates to true.
hide
|
|
| 911 | | | str = clp->data; |
| 912 | | | |
| 913 | | | |
| 914 | | | |
| 915 | | | str_len = strlen(str); |
| 916 | | | quoted_str = g_malloc(str_len*2 + 1); |
| 917 | | | |
| 918 | | | |
| 919 | | | strp = str; |
| 920 | | | quoted_strp = quoted_str; |
| 921 | | | while ((c = *strp++) != '\0') { |
| 922 | | | if (c == '"' || c == '\\') { |
| 923 | | | |
| 924 | | | *quoted_strp++ = '\\'; |
| 925 | | | } |
| 926 | | | *quoted_strp++ = c; |
| 927 | | | } |
| 928 | | | *quoted_strp = '\0'; |
| 929 | | | |
| 930 | | | fmt_len = strlen(quoted_str) + 4; |
| 931 | | | if ((fmt_len + cur_len) < (MAX_FMT_PREF_LEN - 1)) { |
Event 6:
Taking true branch. fmt_len + cur_len < 1024 - 1 evaluates to true.
hide
|
|
| 932 | | | if ((fmt_len + cur_pos) > MAX_FMT_PREF_LINE_LEN) { |
Event 7:
Taking true branch. fmt_len + cur_pos > 60 evaluates to true.
hide
|
|
| 933 | | | |
| 934 | | | cur_len--; |
Event 8:
cur_len is set to cur_len - 1, which evaluates to -1. See related event 2.
hide
|
|
| 935 | | | cur_pos = 0; |
| 936 | | | pref_str[cur_len] = '\n'; cur_len++; |
Buffer Underrun
This code writes before the beginning of the buffer pref_str. - The first underrun byte is at offset cur_len from the beginning of the object. See related event 8.
- The underrun occurs in static memory.
The issue can occur if the highlighted code executes. See related event 8. Show: All events | Only primary events |
|
| |