(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-pflog.c) |
| |
| 118 | | | dissect_pflog(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) |
| 119 | | | { |
| 120 | | | #define MAX_RULE_STR 128 |
| 121 | | | struct pfloghdr pflogh; |
| 122 | | | static char rulestr[MAX_RULE_STR]; |
| 123 | | | tvbuff_t *next_tvb; |
| 124 | | | proto_tree *pflog_tree; |
| 125 | | | proto_item *ti; |
| 126 | | | int hdrlen; |
| 127 | | | |
| 128 | [+] | | if (check_col(pinfo->cinfo, COL_PROTOCOL)) |
 |
| 129 | | | col_set_str(pinfo->cinfo, COL_PROTOCOL, "PFLOG"); |
| 130 | | | |
| 131 | | | |
| 132 | | | tvb_memcpy(tvb, (guint8 *)&pflogh, 0, sizeof(pflogh)); |
| 133 | | | |
| 134 | | | |
| 135 | | | pflogh.rulenr = g_ntohl(pflogh.rulenr);
x /usr/include/glib-2.0/glib/gtypes.h |
| |
347 | #define g_ntohl(val) (GUINT32_FROM_BE (val)) |
| |
x /usr/include/glib-2.0/glib/gtypes.h |
| |
322 | #define GUINT32_FROM_BE(val) (GUINT32_TO_BE (val)) |
| |
x /usr/lib/i386-linux-gnu/glib-2.0/include/glibconfig.h |
| |
196 | #define GUINT32_TO_BE(val) (GUINT32_SWAP_LE_BE (val)) |
| |
x /usr/include/glib-2.0/glib/gtypes.h |
| |
229 | # define GUINT32_SWAP_LE_BE(val) (GUINT32_SWAP_LE_BE_IA32 (val)) |
| |
x /usr/include/glib-2.0/glib/gtypes.h |
| |
203 | # define GUINT32_SWAP_LE_BE_IA32(val) \ |
204 | (__extension__ \ |
205 | ({ register guint32 __v, __x = ((guint32) (val)); \ |
206 | if (__builtin_constant_p (__x)) \ |
207 | __v = GUINT32_SWAP_LE_BE_CONSTANT (__x); \ |
208 | else \ |
209 | __asm__ ("bswap %0" \ |
210 | : "=r" (__v) \ |
211 | : "0" (__x)); \ |
212 | __v; })) |
| |
x /usr/include/glib-2.0/glib/gtypes.h |
| |
147 | #define GUINT32_SWAP_LE_BE_CONSTANT(val) ((guint32) ( \ |
148 | (((guint32) (val) & (guint32) 0x000000ffU) << 24) | \ |
149 | (((guint32) (val) & (guint32) 0x0000ff00U) << 8) | \ |
150 | (((guint32) (val) & (guint32) 0x00ff0000U) >> 8) | \ |
151 | (((guint32) (val) & (guint32) 0xff000000U) >> 24))) |
| |
|
Event 3:
Taking false branch. 0 evaluates to false.
hide
|
|
| 136 | | | pflogh.subrulenr = g_ntohl(pflogh.subrulenr);
x /usr/include/glib-2.0/glib/gtypes.h |
| |
347 | #define g_ntohl(val) (GUINT32_FROM_BE (val)) |
| |
x /usr/include/glib-2.0/glib/gtypes.h |
| |
322 | #define GUINT32_FROM_BE(val) (GUINT32_TO_BE (val)) |
| |
x /usr/lib/i386-linux-gnu/glib-2.0/include/glibconfig.h |
| |
196 | #define GUINT32_TO_BE(val) (GUINT32_SWAP_LE_BE (val)) |
| |
x /usr/include/glib-2.0/glib/gtypes.h |
| |
229 | # define GUINT32_SWAP_LE_BE(val) (GUINT32_SWAP_LE_BE_IA32 (val)) |
| |
x /usr/include/glib-2.0/glib/gtypes.h |
| |
203 | # define GUINT32_SWAP_LE_BE_IA32(val) \ |
204 | (__extension__ \ |
205 | ({ register guint32 __v, __x = ((guint32) (val)); \ |
206 | if (__builtin_constant_p (__x)) \ |
207 | __v = GUINT32_SWAP_LE_BE_CONSTANT (__x); \ |
208 | else \ |
209 | __asm__ ("bswap %0" \ |
210 | : "=r" (__v) \ |
211 | : "0" (__x)); \ |
212 | __v; })) |
| |
x /usr/include/glib-2.0/glib/gtypes.h |
| |
147 | #define GUINT32_SWAP_LE_BE_CONSTANT(val) ((guint32) ( \ |
148 | (((guint32) (val) & (guint32) 0x000000ffU) << 24) | \ |
149 | (((guint32) (val) & (guint32) 0x0000ff00U) << 8) | \ |
150 | (((guint32) (val) & (guint32) 0x00ff0000U) >> 8) | \ |
151 | (((guint32) (val) & (guint32) 0xff000000U) >> 24))) |
| |
|
Event 4:
Taking false branch. 0 evaluates to false.
hide
Event 5:
__v is set to an unknown [ ?unknown: the analysis lost precision when tracking this value, so this warning may be a false positive] value . - Determines the value that is cast in the Cast Alters Value warning later.
hide
Event 6:
pflogh.subrulenr is set to __v, which evaluates to the value assigned to __v. See related event 5.
hide
|
|
| 137 | | | |
| 138 | | | hdrlen = BPF_WORDALIGN(pflogh.length);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-pflog.c |
| |
51 | #define BPF_WORDALIGN(x) (((x) + (BPF_ALIGNMENT - 1)) & ~(BPF_ALIGNMENT - 1)) |
| |
|
| 139 | | | |
| 140 | | | if (pflogh.subrulenr == (guint32) -1) |
Event 7:
Taking true branch. pflogh.subrulenr == (guint32)-1 evaluates to true.
hide
Event 8:
Considering the case where pflogh.subrulenr is equal to -1. See related event 6.
hide
|
|
| 141 | | | g_snprintf(rulestr, sizeof(rulestr), "%u", |
| 142 | | | pflogh.rulenr); |
| 143 | | | else |
| 144 | | | g_snprintf(rulestr, sizeof(rulestr), "%u.%s.%u", |
| 145 | | | pflogh.rulenr, pflogh.ruleset, pflogh.subrulenr); |
| 146 | | | |
| 147 | | | if (hdrlen < MIN_PFLOG_HDRLEN) { |
Event 10:
Skipping " if". hdrlen < 45 evaluates to false.
hide
|
|
| 148 | | | if (tree) { |
| 149 | | | ti = proto_tree_add_protocol_format(tree, proto_pflog, tvb, 0, |
| 150 | | | hdrlen, "PF Log invalid length (%u)", hdrlen); |
| 151 | | | } |
| 152 | | | if (check_col(pinfo->cinfo, COL_INFO)) { |
| 153 | | | col_prepend_fstr(pinfo->cinfo, COL_INFO, "Invalid length %u", |
| 154 | | | hdrlen); |
| 155 | | | } |
| 156 | | | return; |
| 157 | | | } |
| 158 | | | |
| 159 | | | if (tree) { |
Event 11:
Taking true branch. tree evaluates to true.
hide
|
|
| 160 | | | ti = proto_tree_add_protocol_format(tree, proto_pflog, tvb, 0, |
| 161 | | | hdrlen, |
| 162 | | | "PF Log %s %s on %s by rule %s", |
| 163 | | | val_to_str(pflogh.af, af_vals, "unknown (%u)"), |
| 164 | | | val_to_str(pflogh.action, action_vals, "unknown (%u)"), |
| 165 | | | pflogh.ifname, |
| 166 | [+] | | rulestr); |
 |
| 167 | | | pflog_tree = proto_item_add_subtree(ti, ett_pflog); |
| 168 | | | |
| 169 | | | proto_tree_add_uint(pflog_tree, hf_pflog_length, tvb, |
| 170 | | | offsetof(struct pfloghdr, length), sizeof(pflogh.length),
x /usr/lib/i386-linux-gnu/gcc/i686-linux-gnu/4.5/include/stddef.h |
| |
411 | #define offsetof(TYPE, MEMBER) __builtin_offsetof (TYPE, MEMBER) |
| |
|
| 171 | | | pflogh.length); |
| 172 | | | proto_tree_add_uint(pflog_tree, hf_pflog_af, tvb, |
| 173 | | | offsetof(struct pfloghdr, af), sizeof(pflogh.af),
x /usr/lib/i386-linux-gnu/gcc/i686-linux-gnu/4.5/include/stddef.h |
| |
411 | #define offsetof(TYPE, MEMBER) __builtin_offsetof (TYPE, MEMBER) |
| |
|
| 174 | | | pflogh.af); |
| 175 | | | proto_tree_add_uint(pflog_tree, hf_pflog_action, tvb, |
| 176 | | | offsetof(struct pfloghdr, action), sizeof(pflogh.action),
x /usr/lib/i386-linux-gnu/gcc/i686-linux-gnu/4.5/include/stddef.h |
| |
411 | #define offsetof(TYPE, MEMBER) __builtin_offsetof (TYPE, MEMBER) |
| |
|
| 177 | | | pflogh.action); |
| 178 | | | proto_tree_add_uint(pflog_tree, hf_pflog_reason, tvb, |
| 179 | | | offsetof(struct pfloghdr, reason), sizeof(pflogh.reason),
x /usr/lib/i386-linux-gnu/gcc/i686-linux-gnu/4.5/include/stddef.h |
| |
411 | #define offsetof(TYPE, MEMBER) __builtin_offsetof (TYPE, MEMBER) |
| |
|
| 180 | | | pflogh.reason); |
| 181 | | | proto_tree_add_string(pflog_tree, hf_pflog_ifname, tvb, |
| 182 | | | offsetof(struct pfloghdr, ifname), sizeof(pflogh.ifname),
x /usr/lib/i386-linux-gnu/gcc/i686-linux-gnu/4.5/include/stddef.h |
| |
411 | #define offsetof(TYPE, MEMBER) __builtin_offsetof (TYPE, MEMBER) |
| |
|
| 183 | | | pflogh.ifname); |
| 184 | | | proto_tree_add_string(pflog_tree, hf_pflog_ruleset, tvb, |
| 185 | | | offsetof(struct pfloghdr, ruleset), sizeof(pflogh.ruleset),
x /usr/lib/i386-linux-gnu/gcc/i686-linux-gnu/4.5/include/stddef.h |
| |
411 | #define offsetof(TYPE, MEMBER) __builtin_offsetof (TYPE, MEMBER) |
| |
|
| 186 | | | pflogh.ruleset); |
| 187 | | | proto_tree_add_int(pflog_tree, hf_pflog_rulenr, tvb, |
| 188 | | | offsetof(struct pfloghdr, rulenr), sizeof(pflogh.rulenr),
x /usr/lib/i386-linux-gnu/gcc/i686-linux-gnu/4.5/include/stddef.h |
| |
411 | #define offsetof(TYPE, MEMBER) __builtin_offsetof (TYPE, MEMBER) |
| |
|
| 189 | | | pflogh.rulenr); |
| 190 | | | proto_tree_add_int(pflog_tree, hf_pflog_subrulenr, tvb, |
| 191 | | | offsetof(struct pfloghdr, subrulenr), sizeof(pflogh.subrulenr),
x /usr/lib/i386-linux-gnu/gcc/i686-linux-gnu/4.5/include/stddef.h |
| |
411 | #define offsetof(TYPE, MEMBER) __builtin_offsetof (TYPE, MEMBER) |
| |
|
| 192 | [+] | | pflogh.subrulenr); |
Event 24:
pflogh.subrulenr, which evaluates to -1, is passed to proto_tree_add_int() as the sixth argument. See related event 8.
hide
|
|
 |
| |