(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-sdp.c) |
| |
| 1459 | | | static void dissect_sdp_media_attribute(tvbuff_t *tvb, packet_info *pinfo, proto_item * ti, transport_info_t *transport_info){ |
| 1460 | | | proto_tree *sdp_media_attribute_tree; |
| 1461 | | | proto_item *fmtp_item, *media_format_item; |
| 1462 | | | proto_tree *fmtp_tree; |
| 1463 | | | gint offset, next_offset, tokenlen, n, colon_offset; |
| 1464 | | | guint8 *field_name; |
| 1465 | | | guint8 *payload_type; |
| 1466 | | | guint8 *attribute_value; |
| 1467 | | | gint *key; |
| 1468 | | | guint8 pt; |
| 1469 | | | gint sdp_media_attrbute_code; |
| 1470 | | | const char *msrp_res = "msrp://"; |
| 1471 | | | const char *h324ext_h223lcparm = "h324ext/h223lcparm"; |
| 1472 | | | gboolean has_more_pars = TRUE; |
Event 1:
!0 evaluates to true.
hide
|
|
| 1473 | | | tvbuff_t *h245_tvb; |
| 1474 | | | |
| 1475 | | | offset = 0; |
| 1476 | | | next_offset = 0; |
| 1477 | | | tokenlen = 0; |
| 1478 | | | |
| 1479 | | | |
| 1480 | | | sdp_media_attribute_tree = proto_item_add_subtree(ti, |
| 1481 | | | ett_sdp_media_attribute); |
| 1482 | | | |
| 1483 | [+] | | colon_offset = tvb_find_guint8(tvb,offset,-1,':'); |
 |
| 1484 | | | |
| 1485 | | | if(colon_offset == -1) |
Event 5:
Skipping " if". colon_offset == -1 evaluates to false.
hide
|
|
| 1486 | | | return; |
| 1487 | | | |
| 1488 | | | |
| 1489 | | | tokenlen = colon_offset - offset; |
| 1490 | | | proto_tree_add_item(sdp_media_attribute_tree, |
| 1491 | | | hf_media_attribute_field, |
| 1492 | | | tvb, offset, tokenlen, FALSE); |
| 1493 | | | field_name = tvb_get_ephemeral_string(tvb, offset, tokenlen); |
| 1494 | [+] | | sdp_media_attrbute_code = find_sdp_media_attribute_names(tvb, offset, tokenlen); |
 |
| 1495 | | | |
| 1496 | | | |
| 1497 | | | offset = colon_offset + 1; |
| 1498 | | | |
| 1499 | | | offset = tvb_skip_wsp(tvb,offset,tvb_length_remaining(tvb,offset)); |
| 1500 | | | |
| 1501 | | | |
| 1502 | | | attribute_value = tvb_get_ephemeral_string(tvb, offset, tvb_length_remaining(tvb, offset)); |
| 1503 | | | |
| 1504 | | | |
| 1505 | | | |
| 1506 | | | |
| 1507 | | | |
| 1508 | | | |
| 1509 | | | switch (sdp_media_attrbute_code){ |
Event 7:
sdp_media_attrbute_code evaluates to 2.
hide
|
|
| 1510 | | | case SDP_RTPMAP: |
| 1511 | | | |
| 1512 | | | next_offset = tvb_find_guint8(tvb,offset,-1,' '); |
| 1513 | | | |
| 1514 | | | if(next_offset == -1) |
| 1515 | | | return; |
| 1516 | | | |
| 1517 | | | tokenlen = next_offset - offset; |
| 1518 | | | |
| 1519 | | | proto_tree_add_item(sdp_media_attribute_tree, hf_media_format, tvb, |
| 1520 1582 |  | | [ Lines 1520 to 1582 omitted. ] |
| 1583 | | | |
| 1584 | | | }else |
| 1585 | | | |
| 1586 | | | if (transport_info->media_count == SDP_MAX_RTP_CHANNELS-1) |
| 1587 | | | g_hash_table_insert(transport_info->media[ transport_info->media_count ].rtp_dyn_payload, |
| 1588 | | | key, g_strdup(transport_info->encoding_name[pt])); |
| 1589 | | | else |
| 1590 | | | g_hash_table_insert(transport_info->media[ transport_info->media_count-1 ].rtp_dyn_payload, |
| 1591 | | | key, g_strdup(transport_info->encoding_name[pt])); |
| 1592 | | | break; |
| 1593 | | | case SDP_FMTP: |
| 1594 | | | if(sdp_media_attribute_tree){ |
Event 8:
Taking true branch. sdp_media_attribute_tree evaluates to true.
hide
|
|
| 1595 | | | guint8 media_format; |
| 1596 | | | |
| 1597 | | | |
| 1598 | | | offset = tvb_skip_wsp(tvb,offset,tvb_length_remaining(tvb,offset)); |
| 1599 | | | |
| 1600 | [+] | | next_offset = tvb_find_guint8(tvb,offset,-1,' '); |
 |
| 1601 | | | |
| 1602 | | | if(next_offset == -1) |
Event 12:
Skipping " if". next_offset == -1 evaluates to false.
hide
|
|
| 1603 | | | return; |
| 1604 | | | |
| 1605 | | | tokenlen = next_offset - offset; |
| 1606 | | | |
| 1607 | | | |
| 1608 | | | media_format_item = proto_tree_add_item(sdp_media_attribute_tree, |
| 1609 | | | hf_media_format, tvb, offset, |
| 1610 | | | tokenlen, FALSE); |
| 1611 | | | media_format = atoi((char*)tvb_get_ephemeral_string(tvb, offset, tokenlen)); |
Event 13:
atoi() returns a potentially dangerous value [ ?potentially dangerous: the value cannot be determined and may come from program input]. - Determines the array index accessed during the type underrun later.
hide
Event 14:
media_format is set to atoi(...). See related event 13.
hide
|
|
| 1612 | | | if (media_format >= SDP_NO_OF_PT) { |
Event 15:
Skipping " if". media_format >= 128 evaluates to false.
hide
|
|
| 1613 | | | return; |
| 1614 | | | } |
| 1615 | | | |
| 1616 | | | |
| 1617 | | | proto_item_append_text(media_format_item, " [%s]", |
| 1618 | | | transport_info->encoding_name[media_format]); |
Type Underrun
The code could read outside transport_info->encoding_name (but inside *transport_info). - The type of transport_info->encoding_name is char*[128].
- The index is media_format. See related event 14.
- media_format evaluates to atoi(...) from packet-sdp.c:1611, which is bounded above by 127.
- If media_format is negative, an underrun will occur. The analysis cannot rule out the possibility of media_format taking on one or more of these dangerous values, so has issued this warning.
The issue can occur if the highlighted code executes. See related event 14. Show: All events | Only primary events |
|
| |