(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smb2.c) |
| |
| 3085 | | | dissect_smb2_class_infolevel(packet_info *pinfo, tvbuff_t *tvb, int offset, proto_tree *tree, smb2_info_t *si) |
| 3086 | | | { |
| 3087 | | | char cl, il; |
| 3088 | | | proto_item *item; |
| 3089 | | | int hfindex; |
| 3090 | | | static const value_string dummy_value_string[] = { |
| 3091 | | | { 0, NULL } |
| 3092 | | | }; |
| 3093 | | | const value_string *vs; |
| 3094 | | | |
| 3095 | | | if(si->flags & SMB2_FLAGS_RESPONSE){ |
Event 1:
Taking true branch. si->flags & 1 evaluates to true.
hide
|
|
| 3096 | | | if(!si->saved){ |
Event 2:
Skipping " if". si->saved evaluates to true.
hide
|
|
| 3097 | | | return offset; |
| 3098 | | | } |
| 3099 | | | cl=si->saved->class; |
| 3100 | | | il=si->saved->infolevel; |
| 3101 | | | } else { |
| 3102 | | | cl=tvb_get_guint8(tvb, offset); |
| 3103 | | | il=tvb_get_guint8(tvb, offset+1); |
| 3104 | | | if(si->saved){ |
| 3105 | | | si->saved->class=cl; |
| 3106 | | | si->saved->infolevel=il; |
| 3107 | | | } |
| 3108 | | | } |
| 3109 | | | |
| 3110 | | | |
| 3111 | | | switch(cl){ |
Event 3:
Executing default case.
hide
|
|
| 3112 | | | case SMB2_CLASS_FILE_INFO: |
| 3113 | | | hfindex=hf_smb2_infolevel_file_info; |
| 3114 | | | vs=smb2_file_info_levels; |
| 3115 | | | break; |
| 3116 | | | case SMB2_CLASS_FS_INFO: |
| 3117 | | | hfindex=hf_smb2_infolevel_fs_info; |
| 3118 | | | vs=smb2_fs_info_levels; |
| 3119 | | | break; |
| 3120 | | | case SMB2_CLASS_SEC_INFO: |
| 3121 | | | hfindex=hf_smb2_infolevel_sec_info; |
| 3122 | | | vs=smb2_sec_info_levels; |
| 3123 | | | break; |
| 3124 | | | default: |
| 3125 | | | hfindex=hf_smb2_infolevel; |
| 3126 | | | vs=dummy_value_string; |
Event 4:
vs is set to dummy_value_string. - This points to the buffer that will be overrun later.
hide
|
|
| 3127 | | | } |
| 3128 | | | |
| 3129 | | | |
| 3130 | | | |
| 3131 | | | item=proto_tree_add_uint(tree, hf_smb2_class, tvb, offset, 1, cl); |
| 3132 | | | if(si->flags & SMB2_FLAGS_RESPONSE){ |
Event 5:
Skipping " if". si->flags & 1 evaluates to false.
hide
|
|
| 3133 | | | PROTO_ITEM_SET_GENERATED(item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
325 | #define PROTO_ITEM_SET_GENERATED(proto_item) \ |
326 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_GENERATED) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
| 3134 | | | } |
| 3135 | | | |
| 3136 | | | item=proto_tree_add_uint(tree, hfindex, tvb, offset+1, 1, il); |
| 3137 | | | if(si->flags & SMB2_FLAGS_RESPONSE){ |
Event 6:
Skipping " if". si->flags & 1 evaluates to false.
hide
|
|
| 3138 | | | PROTO_ITEM_SET_GENERATED(item);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
325 | #define PROTO_ITEM_SET_GENERATED(proto_item) \ |
326 | ((proto_item) ? FI_SET_FLAG((proto_item)->finfo, FI_GENERATED) : 0) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
246 | #define FI_SET_FLAG(fi, flag) (fi->flags = fi->flags | flag) |
| |
|
| 3139 | | | } |
| 3140 | | | offset += 2; |
| 3141 | | | |
| 3142 | | | if(!(si->flags & SMB2_FLAGS_RESPONSE)){ |
Event 7:
Taking true branch. si->flags & 1 evaluates to false.
hide
|
|
| 3143 | | | |
| 3144 | | | |
| 3145 | | | |
| 3146 | | | |
| 3147 | [+] | | if (check_col(pinfo->cinfo, COL_INFO)){ |
 |
| 3148 | | | col_append_fstr(pinfo->cinfo, COL_INFO, " %s/%s", |
| 3149 | | | val_to_str(cl, smb2_class_vals, "(Class:0x%02x)"), |
| 3150 | [+] | | val_to_str(il, vs, "(Level:0x%02x)")); |
Event 12:
vs, which evaluates to dummy_value_string, is passed to val_to_str() as the second argument. See related event 4.
hide
|
|
 |
| |