(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-dcm.c) |
| |
| 5078 | | | dissect_dcm_tag_value(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, dcm_state_pdv_t *pdv, |
| 5079 | | | guint32 offset, guint16 grp, guint16 elm, |
| 5080 | | | guint32 vl, guint32 vl_max, gchar* vr, gchar **tag_value) |
| 5081 | | | { |
| 5082 | | | |
| 5083 | | | |
| 5084 | | | proto_item *pitem = NULL; |
| 5085 | | | |
| 5086 | | | gboolean is_little_endian; |
| 5087 | | | |
| 5088 | | | if (pdv->syntax == DCM_EBE) is_little_endian = FALSE; |
Event 1:
Taking true branch. pdv->syntax == 2 evaluates to true.
hide
|
|
| 5089 | | | else is_little_endian = TRUE; |
| 5090 | | | |
| 5091 | | | |
| 5092 | | | |
| 5093 | | | |
| 5094 | | | |
| 5095 | | | |
| 5096 | | | |
| 5097 | | | if ((strncmp(vr, "AE", 2) == 0) || (strncmp(vr, "AS", 2) == 0) || (strncmp(vr, "CS", 2) == 0) || |
Event 2:
Taking true branch. strncmp(vr, "AE", 2) == 0 evaluates to true.
hide
|
|
| 5098 | | | (strncmp(vr, "DA", 2) == 0) || (strncmp(vr, "DS", 2) == 0) || (strncmp(vr, "DT", 2) == 0) || |
| 5099 | | | (strncmp(vr, "IS", 2) == 0) || (strncmp(vr, "LO", 2) == 0) || (strncmp(vr, "LT", 2) == 0) || |
| 5100 | | | (strncmp(vr, "PN", 2) == 0) || (strncmp(vr, "SH", 2) == 0) || (strncmp(vr, "ST", 2) == 0) || |
| 5101 | | | (strncmp(vr, "TM", 2) == 0) || (strncmp(vr, "UI", 2) == 0) || (strncmp(vr, "UT", 2) == 0) ) { |
| 5102 | | | |
| 5103 | | | |
| 5104 | | | gchar *vals; |
| 5105 | | | dcm_uid_t *uid = NULL; |
| 5106 | | | guint8 val8; |
| 5107 | | | |
| 5108 | | | val8 = tvb_get_guint8(tvb, offset + vl_max - 1); |
| 5109 | | | if (val8 == 0x00) { |
Event 3:
Taking true branch. val8 == 0 evaluates to true.
hide
|
|
| 5110 | | | |
| 5111 | [+] | | vals = tvb_format_text(tvb, offset, vl_max - 1); |
 |
| 5112 | | | } |
| 5113 | | | else { |
| 5114 | | | vals = tvb_format_text(tvb, offset, vl_max); |
| 5115 | | | } |
| 5116 | | | |
| 5117 | | | if ((strncmp(vr, "UI", 2) == 0) && vals != NULL) { |
Event 11:
Considering the case where vals is equal to 0. See related event 9.
hide
|
|
| 5118 | | | |
| 5119 | | | |
| 5120 | | | uid = g_hash_table_lookup(dcm_uid_table, (gpointer) vals); |
| 5121 | | | if (uid) { |
| 5122 | | | g_snprintf(*tag_value, MAX_BUF_LEN, "%s (%s)", vals, uid->name); |
| 5123 | | | } |
| 5124 | | | else { |
| 5125 | | | g_snprintf(*tag_value, MAX_BUF_LEN, "%s", vals); |
| 5126 | | | } |
| 5127 | | | } |
| 5128 | | | else { |
| 5129 | | | if (strlen(vals) > 50) { |
Event 12:
vals, which evaluates to NULL, is passed to __builtin_strlen(). See related event 11.
hide
Null Pointer Dereference
The body of __builtin_strlen() dereferences vals, but it is NULL. The issue can occur if the highlighted code executes. See related event 12. Show: All events | Only primary events |
|
| |