(/home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/asn1/packet-asn1.c) |
| |
| 2374 | | | define_typedef(GNode *p, GNode *q) |
| 2375 | | | { |
| 2376 | | | TBLTypeDef *type_def = g_malloc(sizeof(TBLTypeDef)); |
| 2377 | | | |
| 2378 | | | GNode *t = g_node_append_data(q, type_def);
x /usr/include/glib-2.0/glib/gnode.h |
| |
205 | #define g_node_append_data(parent, data) \ |
206 | g_node_insert_before ((parent), NULL, g_node_new (data)) |
| |
|
| 2379 | | | |
| 2380 | | | |
| 2381 | | | |
| 2382 | | | type_def->type = TBLTYPE_TypeDef; |
| 2383 | | | |
| 2384 | | | p = g_node_first_child(p);
x /usr/include/glib-2.0/glib/gnode.h |
| |
280 | #define g_node_first_child(node) ((node) ? \ |
281 | ((GNode*) (node))->children : NULL) |
| |
|
Event 4:
p evaluates to true.
hide
|
|
| 2385 | | | |
| 2386 | | | type_def->typeDefId = get_asn1_uint(GPOINTER_TO_UINT(p->data)); |
| 2387 | | | p = g_node_next_sibling(p);
x /usr/include/glib-2.0/glib/gnode.h |
| |
268 | #define g_node_next_sibling(node) ((node) ? \ |
269 | ((GNode*) (node))->next : NULL) |
| |
|
Event 5:
p evaluates to true.
hide
|
|
| 2388 | | | |
| 2389 | | | type_def->typeName = get_asn1_string(BER_UNI_TAG_PrintableString, GPOINTER_TO_UINT(p->data)); |
| 2390 | | | p = g_node_next_sibling(p);
x /usr/include/glib-2.0/glib/gnode.h |
| |
268 | #define g_node_next_sibling(node) ((node) ? \ |
269 | ((GNode*) (node))->next : NULL) |
| |
|
Event 6:
p evaluates to true.
hide
|
|
| 2391 | | | |
| 2392 | [+] | | define_type(g_node_first_child(p), t);
x /usr/include/glib-2.0/glib/gnode.h |
| |
280 | #define g_node_first_child(node) ((node) ? \ |
281 | ((GNode*) (node))->children : NULL) |
| |
|
Event 7:
p evaluates to false.
hide
Event 8:
p ? ((GNode *)p)->children : (void *)0, which evaluates to NULL, is passed to define_type() as the first argument. - Dereferenced later, causing the null pointer dereference.
hide
|
|
 |
| |