(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-teamspeak2.c) |
| |
| 375 | | | static void ts2_standard_dissect(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ts2_tree, ts2_conversation *conversation_data) |
| 376 | | | { |
| 377 | | | guint8 save_fragmented; |
| 378 | | | tvbuff_t *new_tvb, *next_tvb; |
| 379 | | | fragment_data *frag_msg ; |
| 380 | | | guint16 fragment_number; |
| 381 | | | ts2_frag *frag; |
| 382 | | | gboolean outoforder; |
| 383 | | | |
| 384 | | | guint16 type = tvb_get_letohs(tvb, 2); |
| 385 | | | |
| 386 | | | proto_tree_add_item(ts2_tree, hf_ts2_seqnum, tvb, 12, 4, TRUE); |
Event 1:
!0 evaluates to true.
hide
|
|
| 387 | | | |
| 388 | | | |
| 389 | | | |
| 390 | [+] | | if ( ! ( frag = p_get_proto_data(pinfo->fd, proto_ts2) ) ) { |
 |
| 391 | | | frag = se_alloc(sizeof(ts2_frag)); |
| 392 | | | frag->frag_num=0; |
| 393 | | | } |
| 394 | | | |
| 395 | | | |
| 396 | | | |
| 397 | | | |
| 398 | | | if(!(pinfo->fd->flags.visited)) |
Event 5:
Skipping " if". pinfo->fd->flags.visited evaluates to true.
hide
|
|
| 399 | | | { |
| 400 | | | if(conversation_data->server_port == pinfo->srcport) |
| 401 | | | { |
| 402 | | | frag->fragmented = ts2_standard_find_fragments(tvb, &conversation_data->last_inorder_server_frame, &conversation_data->server_frag_size, &conversation_data->server_frag_num, &outoforder); |
| 403 | | | frag->frag_num=conversation_data->server_frag_num; |
| 404 | | | frag->frag_size=conversation_data->server_frag_size; |
| 405 | | | } |
| 406 | | | else |
| 407 | | | { |
| 408 | | | |
| 409 | | | frag->fragmented = ts2_standard_find_fragments(tvb, &conversation_data->last_inorder_client_frame, &conversation_data->client_frag_size, &conversation_data->client_frag_num, &outoforder); |
| 410 | | | frag->frag_num=conversation_data->client_frag_num; |
| 411 | | | frag->frag_size=conversation_data->client_frag_size; |
| 412 | | | } |
| 413 | | | frag->outoforder=outoforder; |
| 414 | | | p_add_proto_data(pinfo->fd, proto_ts2, frag); |
| 415 | | | } |
| 416 | | | |
| 417 | | | |
| 418 | [+] | | frag = p_get_proto_data(pinfo->fd, proto_ts2); |
 |
| 419 | | | |
| 420 | | | proto_tree_add_item(ts2_tree, hf_ts2_resend_count, tvb, 16, 2, TRUE); |
Event 10:
!0 evaluates to true.
hide
|
|
| 421 | | | proto_tree_add_item(ts2_tree, hf_ts2_fragmentnumber, tvb, 18, 2, TRUE); |
Event 11:
!0 evaluates to true.
hide
|
|
| 422 | | | ts2_add_checked_crc32(ts2_tree, hf_ts2_crc32, tvb, 20, tvb_get_letohl(tvb, 20)); |
| 423 | | | |
| 424 | | | |
| 425 | | | new_tvb = NULL; |
| 426 | | | if(frag->fragmented) |
Null Pointer Dereference
frag is dereferenced here, but it is NULL. The issue can occur if the highlighted code executes. See related event 9. Show: All events | Only primary events |
|
| |