(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-ldss.c) |
| |
| 457 | | | dissect_ldss_transfer (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) |
| 458 | | | { |
| 459 | | | conversation_t *transfer_conv; |
| 460 | | | ldss_transfer_info_t *transfer_info; |
| 461 | | | struct tcpinfo *transfer_tcpinfo; |
| 462 | | | |
| 463 | | | proto_tree *ti, *line_tree = NULL, *ldss_tree = NULL; |
| 464 | | | |
| 465 | | | nstime_t broadcast_response_time; |
| 466 | | | |
| 467 | | | |
| 468 | | | |
| 469 | | | transfer_conv = find_conversation (pinfo->fd->num, &pinfo->src, &pinfo->dst, |
| 470 | | | PT_TCP, pinfo->srcport, pinfo->destport, 0); |
| 471 | [+] | | transfer_info = conversation_get_proto_data(transfer_conv, proto_ldss); |
 |
| 472 | | | transfer_tcpinfo = pinfo->private_data; |
| 473 | | | |
| 474 | | | |
| 475 | | | |
| 476 | | | |
| 477 | | | |
| 478 | | | if (transfer_tcpinfo->seq == 1 && |
Event 5:
Taking false branch. transfer_tcpinfo->seq == 1 evaluates to false.
hide
|
|
| 479 | | | transfer_tcpinfo->lastackseq == 1 && |
| 480 | | | transfer_info->broadcast->message_id == MESSAGE_ID_WILLSEND) { |
| 481 | | | |
| 482 | | | |
| 483 | | | |
| 484 | | | |
| 485 | | | |
| 486 | | | |
| 487 | | | |
| 488 | | | guint offset = 0; |
| 489 632 |  | | [ Lines 489 to 632 omitted. ] |
| 633 | | | if (tree && transfer_info->resp_num != 0) { |
| 634 | | | ti = proto_tree_add_uint(ldss_tree, hf_ldss_response_in, |
| 635 | | | tvb, 0, 0, transfer_info->resp_num); |
| 636 | | | PROTO_ITEM_SET_GENERATED(ti);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
325 | #define PROTO_ITEM_SET_GENERATED(proto_item) \ |
326 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_GENERATED) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
| 637 | | | } |
| 638 | | | |
| 639 | | | transfer_info->req->num = pinfo->fd->num; |
| 640 | | | transfer_info->req->ts = pinfo->fd->abs_ts; |
| 641 | | | } |
| 642 | | | |
| 643 | | | else { |
| 644 | | | guint64 size; |
| 645 | | | guint64 offset; |
| 646 | | | guint8 compression; |
| 647 | | | |
| 648 | | | |
| 649 | | | |
| 650 | | | |
| 651 | | | |
| 652 | | | |
| 653 | | | if (transfer_info->broadcast->message_id == MESSAGE_ID_WILLSEND && |
Null Pointer Dereference
transfer_info is dereferenced here, but it is NULL. The issue can occur if the highlighted code executes. See related event 4. Show: All events | Only primary events |
|
| |