(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-tcp.c) |
| |
| 2320 | | | dissect_tcpopt_scps(const ip_tcp_opt *optp, tvbuff_t *tvb, |
| 2321 | | | int offset, guint optlen, packet_info *pinfo, |
| 2322 | | | proto_tree *opt_tree) |
| 2323 | | | { |
| 2324 | | | struct tcp_analysis *tcpd=NULL; |
| 2325 | | | proto_tree *field_tree = NULL; |
| 2326 | | | tcp_flow_t *flow; |
| 2327 | | | int direction; |
| 2328 | | | proto_item *tf = NULL, *hidden_item; |
| 2329 | | | gchar flags[64] = "<None>"; |
| 2330 | | | gchar *fstr[] = {"BETS", "SNACK1", "SNACK2", "COMP", "NLTS", "RESV1", "RESV2", "RESV3"}; |
| 2331 | | | gint i, bpos; |
| 2332 | | | guint8 capvector; |
| 2333 | | | guint8 connid; |
| 2334 | | | |
| 2335 | [+] | | tcpd = get_tcp_conversation_data(NULL,pinfo); |
 |
| 2336 | | | |
| 2337 | | | |
| 2338 | | | direction=CMP_ADDRESS(&pinfo->src, &pinfo->dst);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/address.h |
| |
78 | #define CMP_ADDRESS(addr1, addr2) \ |
79 | ( ((addr1)->type > (addr2)->type)?1: \ |
80 | ((addr1)->type < (addr2)->type)?-1: \ |
81 | ((addr1)->len > (addr2)->len) ?1: \ |
82 | ((addr1)->len < (addr2)->len) ?-1: \ |
83 | memcmp((addr1)->data, (addr2)->data, (addr1)->len)\ |
84 | ) |
| |
|
Event 6:
(&pinfo->src)->type > (&pinfo->dst)->type evaluates to true.
hide
|
|
| 2339 | | | |
| 2340 | | | |
| 2341 | | | if(direction==0) { |
Event 7:
Skipping " if". direction == 0 evaluates to false.
hide
|
|
| 2342 | | | direction= (pinfo->srcport > pinfo->destport) ? 1 : -1; |
| 2343 | | | } |
| 2344 | | | |
| 2345 | | | if(direction>=0) |
Event 8:
Taking true branch. direction >= 0 evaluates to true.
hide
|
|
| 2346 | | | flow =&(tcpd->flow1); |
Event 9:
flow is set to &tcpd->flow1, which evaluates to NULL. See related event 5.
hide
|
|
| 2347 | | | else |
| 2348 | | | flow =&(tcpd->flow2); |
| 2349 | | | |
| 2350 | | | |
| 2351 | | | |
| 2352 | | | |
| 2353 | | | |
| 2354 | | | if (optlen == 4) { |
Event 10:
Taking true branch. optlen == 4 evaluates to true.
hide
|
|
| 2355 | | | capvector = tvb_get_guint8(tvb, offset + 2); |
| 2356 | | | flags[0] = '\0'; |
| 2357 | | | |
| 2358 | | | |
| 2359 | | | for (i = 0; i < 5; i++) { |
| 2360 | | | bpos = 128 >> i; |
| 2361 | | | if (capvector & bpos) { |
| 2362 | | | if (flags[0]) { |
| 2363 | | | g_strlcat(flags, ", ", 64); |
| 2364 | | | } |
| 2365 | | | g_strlcat(flags, fstr[i], 64); |
| 2366 | | | } |
| 2367 | | | } |
| 2368 | | | |
| 2369 | | | |
| 2370 | | | |
| 2371 | | | |
| 2372 | | | if (capvector & 0x10) |
Event 12:
Taking true branch. capvector & 16 evaluates to true.
hide
|
|
| 2373 | | | connid = tvb_get_guint8(tvb, offset + 3); |
| 2374 | | | else |
| 2375 | | | connid = 0; |
| 2376 | | | |
| 2377 | | | tf = proto_tree_add_uint_format(opt_tree, hf_tcp_option_scps_vector, tvb, |
| 2378 | | | offset, optlen, capvector, |
| 2379 | | | "%s: 0x%02x (%s)", |
| 2380 | | | optp->name, capvector, flags); |
| 2381 | | | hidden_item = proto_tree_add_boolean(opt_tree, hf_tcp_option_scps, |
| 2382 | | | tvb, offset, optlen, TRUE); |
Event 13:
!0 evaluates to true.
hide
|
|
| 2383 | | | PROTO_ITEM_SET_HIDDEN(hidden_item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
319 | #define PROTO_ITEM_SET_HIDDEN(proto_item) \ |
320 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_HIDDEN) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
Event 14:
hidden_item evaluates to true.
hide
|
|
| 2384 | | | |
| 2385 | | | field_tree = proto_item_add_subtree(tf, ett_tcp_option_scps); |
| 2386 | | | |
| 2387 | | | proto_tree_add_boolean(field_tree, hf_tcp_scpsoption_flags_bets, tvb, |
| 2388 | | | offset + 13, 1, capvector); |
| 2389 | | | proto_tree_add_boolean(field_tree, hf_tcp_scpsoption_flags_snack1, tvb, |
| 2390 | | | offset + 13, 1, capvector); |
| 2391 | | | proto_tree_add_boolean(field_tree, hf_tcp_scpsoption_flags_snack2, tvb, |
| 2392 | | | offset + 13, 1, capvector); |
| 2393 | | | proto_tree_add_boolean(field_tree, hf_tcp_scpsoption_flags_compress, tvb, |
| 2394 | | | offset + 13, 1, capvector); |
| 2395 | | | proto_tree_add_boolean(field_tree, hf_tcp_scpsoption_flags_nlts, tvb, |
| 2396 | | | offset + 13, 1, capvector); |
| 2397 | | | proto_tree_add_boolean(field_tree, hf_tcp_scpsoption_flags_resv1, tvb, |
| 2398 | | | offset + 13, 1, capvector); |
| 2399 | | | proto_tree_add_boolean(field_tree, hf_tcp_scpsoption_flags_resv2, tvb, |
| 2400 | | | offset + 13, 1, capvector); |
| 2401 | | | proto_tree_add_boolean(field_tree, hf_tcp_scpsoption_flags_resv3, tvb, |
| 2402 | | | offset + 13, 1, capvector); |
| 2403 | | | |
| 2404 | | | tcp_info_append_str(pinfo, "SCPS", flags); |
| 2405 | | | |
| 2406 | | | flow->scps_capable = 1; |
Null Pointer Dereference
flow is dereferenced here, but it is NULL. The issue can occur if the highlighted code executes. See related event 9. Show: All events | Only primary events |
|
| |