(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smb.c) |
| |
| 8514 | | | dissect_nt_transaction_request(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, proto_tree *smb_tree _U_) |
| 8515 | | | { |
| 8516 | | | guint8 wc, sc; |
| 8517 | | | guint32 pc=0, po=0, pd, dc=0, od=0, dd; |
| 8518 | | | smb_info_t *si; |
| 8519 | | | smb_saved_info_t *sip; |
| 8520 | | | int subcmd; |
| 8521 | | | nt_trans_data ntd; |
| 8522 | | | guint16 bc; |
| 8523 | | | guint32 padcnt; |
| 8524 | | | smb_nt_transact_info_t *nti=NULL; |
Event 1:
nti is set to NULL. - Dereferenced later, causing the null pointer dereference.
hide
|
|
| 8525 | | | |
| 8526 | | | ntd.subcmd = ntd.sd_len = ntd.ea_len = 0; |
| 8527 | | | |
| 8528 | | | si = (smb_info_t *)pinfo->private_data; |
| 8529 | | | DISSECTOR_ASSERT(si);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
117 | #define DISSECTOR_ASSERT(expression) \ |
118 | ((void) ((expression) ? (void)0 : \ |
119 | __DISSECTOR_ASSERT (expression, __FILE__, __LINE__))) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
138 | #define __DISSECTOR_ASSERT(expression, file, lineno) \ |
139 | (REPORT_DISSECTOR_BUG( \ |
140 | ep_strdup_printf("%s:%u: failed assertion \"%s\"", \ |
141 | file, lineno, __DISSECTOR_ASSERT_STRINGIFY(expression)))) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/proto.h |
| |
106 | #define REPORT_DISSECTOR_BUG(message) \ |
107 | ((getenv("WIRESHARK_ABORT_ON_DISSECTOR_BUG") != NULL) ? \ |
108 | abort() : \ |
109 | THROW_MESSAGE(DissectorError, message)) |
| |
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/exceptions.h |
| |
226 | #define THROW_MESSAGE(x, y) \ |
227 | except_throw(XCEPT_GROUP_WIRESHARK, (x), (y)) |
| |
|
Event 2:
si evaluates to true.
hide
|
|
| 8530 | | | sip = si->sip; |
| 8531 | | | |
| 8532 | | | WORD_COUNT;
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smb.c |
| |
784 | #define WORD_COUNT \ |
785 | /* Word Count */ \ |
786 | wc = tvb_get_guint8(tvb, offset); \ |
787 | proto_tree_add_uint(tree, hf_smb_word_count, \ |
788 | tvb, offset, 1, wc); \ |
789 | offset += 1; \ |
790 | if(wc==0) goto bytecount; |
| |
|
Event 3:
Skipping " if". wc == 0 evaluates to false.
hide
|
|
| 8533 | | | |
| 8534 | | | if(wc>=19){ |
Event 4:
Taking false branch. wc >= 19 evaluates to false.
hide
|
|
| 8535 | | | |
| 8536 | | | |
| 8537 | | | proto_tree_add_item(tree, hf_smb_max_setup_count, tvb, offset, 1, TRUE); |
| 8538 | | | offset += 1; |
| 8539 | | | |
| 8540 | | | |
| 8541 | | | proto_tree_add_item(tree, hf_smb_reserved, tvb, offset, 2, TRUE); |
| 8542 | | | offset += 2; |
| 8543 | | | } else { |
| 8544 | | | |
| 8545 | | | |
| 8546 | | | proto_tree_add_item(tree, hf_smb_reserved, tvb, offset, 3, TRUE); |
Event 5:
!0 evaluates to true.
hide
|
|
| 8547 | | | offset += 3; |
| 8548 | | | } |
| 8549 | | | |
| 8550 | | | |
| 8551 | | | |
| 8552 | | | proto_tree_add_item(tree, hf_smb_total_param_count, tvb, offset, 4, TRUE); |
Event 6:
!0 evaluates to true.
hide
|
|
| 8553 | | | offset += 4; |
| 8554 | | | |
| 8555 | | | |
| 8556 | | | proto_tree_add_item(tree, hf_smb_total_data_count, tvb, offset, 4, TRUE); |
Event 7:
!0 evaluates to true.
hide
|
|
| 8557 | | | offset += 4; |
| 8558 | | | |
| 8559 | | | if(wc>=19){ |
Event 8:
Taking true branch. wc >= 19 evaluates to true.
hide
|
|
| 8560 | | | |
| 8561 | | | |
| 8562 | | | proto_tree_add_item(tree, hf_smb_max_param_count, tvb, offset, 4, TRUE); |
Event 9:
!0 evaluates to true.
hide
|
|
| 8563 | | | offset += 4; |
| 8564 | | | |
| 8565 | | | |
| 8566 | | | proto_tree_add_item(tree, hf_smb_max_data_count, tvb, offset, 4, TRUE); |
Event 10:
!0 evaluates to true.
hide
|
|
| 8567 | | | offset += 4; |
| 8568 | | | } |
| 8569 | | | |
| 8570 | | | |
| 8571 | [+] | | pc = tvb_get_letohl(tvb, offset); |
 |
| 8572 | | | proto_tree_add_uint(tree, hf_smb_param_count32, tvb, offset, 4, pc); |
| 8573 | | | offset += 4; |
| 8574 | | | |
| 8575 | | | |
| 8576 | [+] | | po = tvb_get_letohl(tvb, offset); |
 |
| 8577 | | | proto_tree_add_uint(tree, hf_smb_param_offset32, tvb, offset, 4, po); |
| 8578 | | | offset += 4; |
| 8579 | | | |
| 8580 | | | |
| 8581 | | | if(wc>=19){ |
Event 11:
Taking true branch. wc >= 19 evaluates to true.
hide
|
|
| 8582 | | | |
| 8583 | | | pd = 0; |
| 8584 | | | } else { |
| 8585 | | | |
| 8586 | | | pd = tvb_get_letohl(tvb, offset); |
| 8587 | | | proto_tree_add_uint(tree, hf_smb_param_disp32, tvb, offset, 4, pd); |
| 8588 | | | offset += 4; |
| 8589 | | | } |
| 8590 | | | |
| 8591 | | | |
| 8592 | [+] | | dc = tvb_get_letohl(tvb, offset); |
 |
| 8593 | | | proto_tree_add_uint(tree, hf_smb_data_count32, tvb, offset, 4, dc); |
| 8594 | | | offset += 4; |
| 8595 | | | |
| 8596 | | | |
| 8597 | | | od = tvb_get_letohl(tvb, offset); |
| 8598 | | | proto_tree_add_uint(tree, hf_smb_data_offset32, tvb, offset, 4, od); |
| 8599 | | | offset += 4; |
| 8600 | | | |
| 8601 | | | |
| 8602 | | | if(wc>=19){ |
Event 12:
Taking true branch. wc >= 19 evaluates to true.
hide
|
|
| 8603 | | | |
| 8604 | | | dd = 0; |
| 8605 | | | } else { |
| 8606 | | | |
| 8607 | | | dd = tvb_get_letohl(tvb, offset); |
| 8608 | | | proto_tree_add_uint(tree, hf_smb_data_disp32, tvb, offset, 4, dd); |
| 8609 | | | offset += 4; |
| 8610 | | | } |
| 8611 | | | |
| 8612 | | | |
| 8613 | | | if(wc>=19){ |
Event 13:
Taking true branch. wc >= 19 evaluates to true.
hide
|
|
| 8614 | | | |
| 8615 | [+] | | sc = tvb_get_guint8(tvb, offset); |
 |
| 8616 | | | proto_tree_add_uint(tree, hf_smb_setup_count, tvb, offset, 1, sc); |
| 8617 | | | offset += 1; |
| 8618 | | | } else { |
| 8619 | | | |
| 8620 | | | sc = 0; |
| 8621 | | | } |
| 8622 | | | |
| 8623 | | | |
| 8624 | | | if(wc>=19){ |
Event 18:
Taking true branch. wc >= 19 evaluates to true.
hide
|
|
| 8625 | | | |
| 8626 | | | subcmd = tvb_get_letohs(tvb, offset); |
| 8627 | | | proto_tree_add_uint(tree, hf_smb_nt_trans_subcmd, tvb, offset, 2, subcmd); |
| 8628 | | | if(check_col(pinfo->cinfo, COL_INFO)){ |
Event 19:
Taking true branch. check_col(...) evaluates to true.
hide
|
|
| 8629 | | | col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", |
| 8630 | | | val_to_str(subcmd, nt_cmd_vals, "<unknown>")); |
| 8631 | | | } |
| 8632 | | | ntd.subcmd = subcmd; |
| 8633 | | | if (!si->unidir && sip) { |
Event 20:
Skipping " if". si->unidir evaluates to true.
hide
|
|
| 8634 | | | if(!pinfo->fd->flags.visited){ |
| 8635 | | | |
| 8636 | | | |
| 8637 | | | |
| 8638 | | | |
| 8639 | | | nti = se_alloc(sizeof(smb_nt_transact_info_t)); |
| 8640 | | | nti->subcmd = subcmd; |
| 8641 | | | nti->fid_type=SMB_FID_TYPE_UNKNOWN; |
| 8642 | | | sip-> = nti; |
| 8643 | | | sip-> = SMB_EI_NTI; |
| 8644 | | | } else { |
| 8645 | | | if(sip-> == SMB_EI_NTI){ |
| 8646 | | | nti=sip->; |
| 8647 | | | } |
| 8648 | | | } |
| 8649 | | | } |
| 8650 | | | } else { |
| 8651 | | | |
| 8652 | | | if(check_col(pinfo->cinfo, COL_INFO)){ |
| 8653 | | | col_append_str(pinfo->cinfo, COL_INFO, " (secondary request)"); |
| 8654 | | | } |
| 8655 | | | } |
| 8656 | | | offset += 2; |
| 8657 | | | |
| 8658 | | | |
| 8659 | | | if(offset%1){ |
Event 21:
Skipping " if". offset % 1 evaluates to false.
hide
|
|
| 8660 | | | |
| 8661 | | | proto_tree_add_item(tree, hf_smb_padding, tvb, offset, 1, TRUE); |
| 8662 | | | offset += 1; |
| 8663 | | | } |
| 8664 | | | |
| 8665 | | | |
| 8666 | | | if(sc){ |
Event 22:
Skipping " if". sc evaluates to false.
hide
|
|
| 8667 | | | dissect_nt_trans_setup_request(tvb, pinfo, offset, tree, sc*2, &ntd); |
| 8668 | | | offset += sc*2; |
| 8669 | | | } |
| 8670 | | | |
| 8671 | [+] | | BYTE_COUNT;
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smb.c |
| |
792 | #define BYTE_COUNT \ |
793 | bytecount: \ |
794 | bc = tvb_get_letohs(tvb, offset); \ |
795 | proto_tree_add_uint(tree, hf_smb_byte_count, \ |
796 | tvb, offset, 2, bc); \ |
797 | offset += 2; \ |
798 | if(bc==0) goto endofcommand; |
| |
|
 |
| 8672 | | | |
| 8673 | | | |
| 8674 | | | if(po>(guint32)offset){ |
Event 24:
Skipping " if". po > (guint32)offset evaluates to false.
hide
|
|
| 8675 | | | |
| 8676 | | | |
| 8677 | | | padcnt = po-offset; |
| 8678 | | | if (padcnt > bc) |
| 8679 | | | padcnt = bc; |
| 8680 | | | CHECK_BYTE_COUNT(padcnt); |
| 8681 | | | proto_tree_add_item(tree, hf_smb_padding, tvb, offset, padcnt, TRUE); |
| 8682 | | | COUNT_BYTES(padcnt);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smb.c |
| |
803 | #define COUNT_BYTES(len) {\ |
804 | int tmp; \ |
805 | tmp=len; \ |
806 | offset += tmp; \ |
807 | bc -= tmp; \ |
808 | } |
| |
|
| 8683 | | | } |
| 8684 | | | if(pc){ |
Event 25:
Skipping " if". pc evaluates to false.
hide
|
|
| 8685 | | | CHECK_BYTE_COUNT(pc); |
| 8686 | | | dissect_nt_trans_param_request(tvb, pinfo, offset, tree, pc, &ntd, bc, nti); |
| 8687 | | | COUNT_BYTES(pc);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smb.c |
| |
803 | #define COUNT_BYTES(len) {\ |
804 | int tmp; \ |
805 | tmp=len; \ |
806 | offset += tmp; \ |
807 | bc -= tmp; \ |
808 | } |
| |
|
| 8688 | | | } |
| 8689 | | | |
| 8690 | | | |
| 8691 | | | if(od>(guint32)offset){ |
Event 26:
Taking true branch. od > (guint32)offset evaluates to true.
hide
|
|
| 8692 | | | |
| 8693 | | | |
| 8694 | | | padcnt = od-offset; |
| 8695 | | | if (padcnt > bc) |
Event 27:
Skipping " if". padcnt > bc evaluates to false.
hide
|
|
| 8696 | | | padcnt = bc; |
| 8697 | | | proto_tree_add_item(tree, hf_smb_padding, tvb, offset, padcnt, TRUE); |
Event 28:
!0 evaluates to true.
hide
|
|
| 8698 | | | COUNT_BYTES(padcnt);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-smb.c |
| |
803 | #define COUNT_BYTES(len) {\ |
804 | int tmp; \ |
805 | tmp=len; \ |
806 | offset += tmp; \ |
807 | bc -= tmp; \ |
808 | } |
| |
|
| 8699 | | | } |
| 8700 | | | if(dc){ |
Event 29:
Taking true branch. dc evaluates to true.
hide
|
|
| 8701 | | | CHECK_BYTE_COUNT(dc); |
Event 30:
Skipping " if". bc < dc evaluates to false.
hide
|
|
| 8702 | | | dissect_nt_trans_data_request( |
| 8703 | [+] | | tvb, pinfo, offset, tree, dc, &ntd, nti); |
Event 31:
nti, which evaluates to NULL, is passed to dissect_nt_trans_data_request() as the seventh argument. See related event 1.
hide
|
|
 |
| |