(/home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/profinet/packet-pn-dcp.c) |
| |
| 298 | | | dissect_PNDCP_Option(tvbuff_t *tvb, int offset, packet_info *pinfo, |
| 299 | | | proto_tree *tree, proto_item *block_item, int hfindex, gboolean append_col) |
| 300 | | | { |
| 301 | | | guint8 option; |
| 302 | | | guint8 suboption; |
| 303 | | | const value_string *val_str; |
| 304 | | | |
| 305 | | | offset = dissect_pn_uint8 (tvb, offset, pinfo, tree, hfindex, &option); |
| 306 | | | switch(option) { |
Event 1:
Executing default case.
hide
|
|
| 307 | | | case(PNDCP_OPTION_IP): |
| 308 | | | offset = dissect_pn_uint8(tvb, offset, pinfo, tree, hf_pn_dcp_suboption_ip, &suboption); |
| 309 | | | val_str = pn_dcp_suboption_ip; |
| 310 | | | break; |
| 311 | | | case(PNDCP_OPTION_DEVICE): |
| 312 | | | offset = dissect_pn_uint8(tvb, offset, pinfo, tree, hf_pn_dcp_suboption_device, &suboption); |
| 313 | | | val_str = pn_dcp_suboption_device; |
| 314 | | | break; |
| 315 | | | case(PNDCP_OPTION_DHCP): |
| 316 | | | offset = dissect_pn_uint8(tvb, offset, pinfo, tree, hf_pn_dcp_suboption_dhcp, &suboption); |
| 317 | | | val_str = pn_dcp_suboption_dhcp; |
| 318 | | | break; |
| 319 | | | case(PNDCP_OPTION_CONTROL): |
| 320 | | | offset = dissect_pn_uint8(tvb, offset, pinfo, tree, hf_pn_dcp_suboption_control, &suboption); |
| 321 | | | val_str = pn_dcp_suboption_control; |
| 322 | | | break; |
| 323 | | | case(PNDCP_OPTION_DEVICEINITIATIVE): |
| 324 | | | offset = dissect_pn_uint8(tvb, offset, pinfo, tree, hf_pn_dcp_suboption_deviceinitiative, &suboption); |
| 325 | | | val_str = pn_dcp_suboption_deviceinitiative; |
| 326 | | | break; |
| 327 | | | case(PNDCP_OPTION_ALLSELECTOR): |
| 328 | | | offset = dissect_pn_uint8(tvb, offset, pinfo, tree, hf_pn_dcp_suboption_all, &suboption); |
| 329 | | | val_str = pn_dcp_suboption_all; |
| 330 | | | break; |
| 331 | | | default: |
| 332 | | | offset = dissect_pn_uint8(tvb, offset, pinfo, tree, hf_pn_dcp_suboption_manuf, &suboption); |
| 333 | | | val_str = pn_dcp_suboption_manuf; |
Event 2:
val_str is set to pn_dcp_suboption_manuf. - This points to the buffer that will be overrun later.
hide
|
|
| 334 | | | } |
| 335 | | | |
| 336 | | | proto_item_append_text(block_item, ", Status from %s - %s", |
| 337 | [+] | | val_to_str(option, pn_dcp_option, "Unknown"), val_to_str(suboption, val_str, "Unknown")); |
Event 3:
val_str, which evaluates to pn_dcp_suboption_manuf, is passed to val_to_str() as the second argument. See related event 2.
hide
|
|
 |
| |