(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dcom.c) |
| |
| 1307 | | | dissect_dcom_VARIANT(tvbuff_t *tvb, int offset, packet_info *pinfo, |
| 1308 | | | proto_tree *tree, guint8 *drep, int hfindex) |
| 1309 | | | { |
| 1310 | | | guint32 u32Size; |
| 1311 | | | guint32 u32RPCRes; |
| 1312 | | | guint16 u16Res; |
| 1313 | | | guint32 u32SubStart; |
| 1314 | | | proto_item *sub_item; |
| 1315 | | | proto_tree *sub_tree; |
| 1316 | | | guint16 u16VarType; |
| 1317 | | | guint32 u32VarType; |
| 1318 | | | |
| 1319 | | | guint8 u8Data; |
| 1320 | | | guint16 u16Data; |
| 1321 | | | guint32 u32Data; |
| 1322 | | | gchar cData[500]; |
| 1323 | | | guint32 u32Pointer; |
| 1324 | | | gfloat f32Data; |
| 1325 | | | gdouble f64Data; |
| 1326 | | | |
| 1327 | | | |
| 1328 | | | |
| 1329 | | | if (offset % 8) { |
Event 1:
Skipping " if". offset % 8 evaluates to false.
hide
|
|
| 1330 | | | offset += 8 - (offset % 8); |
| 1331 | | | } |
| 1332 | | | |
| 1333 | | | sub_item = proto_tree_add_item(tree, hfindex, tvb, offset, 0, FALSE); |
| 1334 | | | sub_tree = proto_item_add_subtree(sub_item, ett_dcom_variant); |
| 1335 | | | u32SubStart = offset; |
| 1336 | | | |
| 1337 | | | |
| 1338 | | | |
| 1339 | | | |
| 1340 | | | |
| 1341 | | | |
| 1342 | | | |
| 1343 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1344 | | | hf_dcom_variant_size, &u32Size); |
| 1345 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1346 | | | hf_dcom_variant_rpc_res, &u32RPCRes); |
| 1347 | | | offset = dissect_dcom_VARTYPE(tvb, offset, pinfo, sub_tree, drep, |
| 1348 | [+] | | &u16VarType); |
Event 2:
dissect_dcom_VARTYPE() does not initialize u16VarType. - This may be because of a failure case or other special case for dissect_dcom_VARTYPE().
hide
|
|
 |
| 1349 | | | offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, drep, |
| 1350 | | | hf_dcom_variant_wres, &u16Res); |
| 1351 | | | offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, drep, |
| 1352 | | | hf_dcom_variant_wres, &u16Res); |
| 1353 | | | offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, drep, |
| 1354 | | | hf_dcom_variant_wres, &u16Res); |
| 1355 | | | |
| 1356 | | | |
| 1357 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1358 | | | hf_dcom_variant_type32, &u32VarType); |
| 1359 | | | |
| 1360 | | | if (u32VarType & WIRESHARK_VT_BYREF) { |
Event 5:
Skipping " if". u32VarType & WIRESHARK_VT_BYREF evaluates to false.
hide
|
|
| 1361 | | | u32VarType &=~WIRESHARK_VT_BYREF; |
| 1362 | | | offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, drep, &u32Pointer); |
| 1363 | | | } |
| 1364 | | | |
| 1365 | | | switch (u32VarType) { |
Event 6:
u32VarType evaluates to 2.
hide
|
|
| 1366 | | | case(WIRESHARK_VT_EMPTY): |
| 1367 | | | break; |
| 1368 | | | case(WIRESHARK_VT_BOOL): |
| 1369 | | | offset = dissect_dcom_VARIANT_BOOL(tvb, offset, pinfo, sub_tree, drep, |
| 1370 | | | hf_dcom_vt_bool, &u16Data); |
| 1371 | | | break; |
| 1372 | | | case(WIRESHARK_VT_I1): |
| 1373 | | | offset = dissect_dcom_BYTE(tvb, offset, pinfo, sub_tree, drep, |
| 1374 | | | hf_dcom_vt_i1, &u8Data); |
| 1375 | | | break; |
| 1376 | | | case(WIRESHARK_VT_UI1): |
| 1377 | | | offset = dissect_dcom_BYTE(tvb, offset, pinfo, sub_tree, drep, |
| 1378 | | | hf_dcom_vt_ui1, &u8Data); |
| 1379 | | | break; |
| 1380 | | | case(WIRESHARK_VT_I2): |
| 1381 | | | offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, drep, |
| 1382 | | | hf_dcom_vt_i2, &u16Data); |
| 1383 | | | break; |
| 1384 | | | case(WIRESHARK_VT_UI2): |
| 1385 | | | offset = dissect_dcom_WORD(tvb, offset, pinfo, sub_tree, drep, |
| 1386 | | | hf_dcom_vt_ui2, &u16Data); |
| 1387 | | | break; |
| 1388 | | | case(WIRESHARK_VT_I4): |
| 1389 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1390 | | | hf_dcom_vt_i4, &u32Data); |
| 1391 | | | break; |
| 1392 | | | case(WIRESHARK_VT_UI4): |
| 1393 | | | offset = dissect_dcom_DWORD(tvb, offset, pinfo, sub_tree, drep, |
| 1394 1437 |  | | [ Lines 1394 to 1437 omitted. ] |
| 1438 | | | offset = dissect_dcom_dcerpc_pointer(tvb, offset, pinfo, sub_tree, drep, &u32Pointer); |
| 1439 | | | break; |
| 1440 | | | default: |
| 1441 | | | |
| 1442 | | | offset = dissect_dcom_tobedone_data(tvb, offset, pinfo, sub_tree, drep, |
| 1443 | | | 10000); |
| 1444 | | | } |
| 1445 | | | |
| 1446 | | | |
| 1447 | | | proto_item_append_text(sub_item, ": %s", |
| 1448 | | | val_to_str(u16VarType, dcom_variant_type_vals, "Unknown (0x%08x)") ); |
Uninitialized Variable
u16VarType was not initialized. The issue can occur if the highlighted code executes. See related events 2 and 3. Show: All events | Only primary events |
|
| |