(/home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/wimaxasncp/packet-wimaxasncp.c) |
| |
| 1956 | | | dissect_wimaxasncp( |
| 1957 | | | tvbuff_t *tvb, |
| 1958 | | | packet_info *pinfo, |
| 1959 | | | proto_tree *tree) |
| 1960 | | | { |
| 1961 | | | const gchar *unknown = "Unknown"; |
| 1962 | | | |
| 1963 | | | |
| 1964 | | | proto_item *packet_item = NULL; |
| 1965 | | | proto_item *item = NULL; |
| 1966 | | | proto_tree *wimaxasncp_tree = NULL; |
| 1967 | | | tvbuff_t *subtree; |
| 1968 | | | |
| 1969 | | | guint offset; |
| 1970 | | | guint8 ui8; |
| 1971 | | | |
| 1972 | | | guint8 function_type; |
| 1973 | | | proto_item *function_type_item; |
| 1974 | | | guint16 length; |
| 1975 | | | |
| 1976 | | | const gchar *message_name; |
| 1977 | | | const wimaxasncp_func_msg_t *p = NULL; |
| 1978 | | | gsize i; |
| 1979 | | | |
| 1980 | | | |
| 1981 | | | |
| 1982 | | | |
| 1983 | | | |
| 1984 | | | |
| 1985 | | | |
| 1986 | | | |
| 1987 | | | |
| 1988 | | | |
| 1989 | | | |
| 1990 | | | |
| 1991 | | | |
| 1992 | | | |
| 1993 | | | |
| 1994 | | | |
| 1995 | | | |
| 1996 | | | if (tvb_bytes_exist(tvb, 0, 1) && tvb_get_guint8(tvb, 0) != 1) |
Event 1:
Skipping " if". tvb_bytes_exist(tvb, 0, 1) evaluates to false.
hide
|
|
| 1997 | | | { |
| 1998 | | | return 0; |
| 1999 | | | } |
| 2000 | | | |
| 2001 | | | |
| 2002 | | | |
| 2003 | | | |
| 2004 | | | |
| 2005 | | | |
| 2006 | | | |
| 2007 | | | if (check_col(pinfo->cinfo, COL_PROTOCOL)) |
Event 2:
Taking true branch. check_col(...) evaluates to true.
hide
|
|
| 2008 | | | { |
| 2009 | | | col_set_str(pinfo->cinfo, COL_PROTOCOL, "WiMAX"); |
| 2010 | | | } |
| 2011 | | | |
| 2012 | | | |
| 2013 | | | |
| 2014 | | | |
| 2015 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
Event 3:
Skipping " if". check_col(...) evaluates to false.
hide
|
|
| 2016 | | | { |
| 2017 | | | col_clear(pinfo->cinfo, COL_INFO); |
| 2018 | | | } |
| 2019 | | | |
| 2020 | | | |
| 2021 | | | |
| 2022 | | | |
| 2023 | | | |
| 2024 | | | |
| 2025 | | | |
| 2026 | | | |
| 2027 | | | |
| 2028 | | | |
| 2029 | | | |
| 2030 | | | offset = 0; |
| 2031 | | | |
| 2032 | | | |
| 2033 | | | if (wimaxasncp_dict == NULL) |
Event 4:
Taking true branch. wimaxasncp_dict == (void *)0 evaluates to true.
hide
|
|
| 2034 | | | { |
| 2035 | | | register_wimaxasncp_fields(NULL); |
| 2036 | | | } |
| 2037 | | | |
| 2038 | | | if (tree) |
Event 5:
Skipping " if". tree evaluates to false.
hide
|
|
| 2039 | | | { |
| 2040 | | | packet_item = proto_tree_add_item( |
| 2041 | | | tree, proto_wimaxasncp, |
| 2042 | | | tvb, 0, MIN(, tvb_length(tvb)), FALSE);
x /usr/include/glib-2.0/glib/gmacros.h |
| |
201 | #define MIN(a, b) (((a) < (b)) ? (a) : (b)) |
| |
|
| 2043 | | | |
| 2044 | | | wimaxasncp_tree = proto_item_add_subtree( |
| 2045 | | | packet_item, ett_wimaxasncp); |
| 2046 | | | } |
| 2047 | | | |
| 2048 | | | |
| 2049 | | | |
| 2050 | | | |
| 2051 | | | |
| 2052 | | | |
| 2053 | | | if (tree) |
Event 6:
Skipping " if". tree evaluates to false.
hide
|
|
| 2054 | | | { |
| 2055 | | | proto_tree_add_item( |
| 2056 | | | wimaxasncp_tree, hf_wimaxasncp_version, |
| 2057 | | | tvb, offset, 1, FALSE); |
| 2058 | | | } |
| 2059 | | | |
| 2060 | | | offset += 1; |
| 2061 | | | |
| 2062 | | | |
| 2063 | | | |
| 2064 | | | |
| 2065 | | | |
| 2066 | | | |
| 2067 | | | ui8 = tvb_get_guint8(tvb, offset); |
| 2068 | | | |
| 2069 | | | if (tree) |
Event 7:
Skipping " if". tree evaluates to false.
hide
|
|
| 2070 | | | { |
| 2071 | | | proto_tree *flags_tree; |
| 2072 | | | guint i; |
| 2073 | | | |
| 2074 | | | if (ui8 == 0) |
| 2075 | | | { |
| 2076 | | | item = proto_tree_add_uint_format( |
| 2077 | | | wimaxasncp_tree, hf_wimaxasncp_flags, |
| 2078 | | | tvb, offset, 1, ui8, |
| 2079 | | | "Flags: 0x%02x", ui8); |
| 2080 | | | } |
| 2081 | | | else |
| 2082 | | | { |
| 2083 | | | item = proto_tree_add_uint_format( |
| 2084 | | | wimaxasncp_tree, hf_wimaxasncp_flags, |
| 2085 | | | tvb, offset, 1, ui8, |
| 2086 | | | "Flags: "); |
| 2087 | | | |
| 2088 | | | if (ui8 & (WIMAXASNCP_FLAGS_T | WIMAXASNCP_FLAGS_R)) |
| 2089 | | | { |
| 2090 | | | if (ui8 & WIMAXASNCP_FLAGS_T) |
| 2091 | | | { |
| 2092 | | | proto_item_append_text(item, "T"); |
| 2093 | | | } |
| 2094 | | | |
| 2095 | | | if (ui8 & WIMAXASNCP_FLAGS_R) |
| 2096 | | | { |
| 2097 | | | proto_item_append_text(item, "R"); |
| 2098 | | | } |
| 2099 | | | |
| 2100 | | | proto_item_append_text(item, " - "); |
| 2101 | | | } |
| 2102 | | | |
| 2103 | | | proto_item_append_text( |
| 2104 | | | item, "%s", decode_numeric_bitfield(ui8, 0xff, 8, "0x%02x")); |
| 2105 | | | |
| 2106 | | | flags_tree = proto_item_add_subtree( |
| 2107 | | | item, ett_wimaxasncp_flags); |
| 2108 | | | |
| 2109 | | | for (i = 0; i < 8; ++i) |
| 2110 | | | { |
| 2111 | | | guint8 mask; |
| 2112 | | | mask = 1 << (7 - i); |
| 2113 | | | |
| 2114 | | | |
| 2115 | | | if (ui8 & mask) |
| 2116 | | | { |
| 2117 | | | proto_tree_add_uint_format( |
| 2118 | | | flags_tree, hf_wimaxasncp_flags, |
| 2119 | | | tvb, offset, 1, ui8, |
| 2120 | | | "Bit #%u is set: %s", |
| 2121 | | | i, |
| 2122 | | | val_to_str( |
| 2123 | | | ui8 & mask, wimaxasncp_flag_vals, "Unknown")); |
| 2124 | | | } |
| 2125 | | | } |
| 2126 | | | } |
| 2127 | | | } |
| 2128 | | | |
| 2129 | | | offset += 1; |
| 2130 | | | |
| 2131 | | | |
| 2132 | | | |
| 2133 | | | |
| 2134 | | | |
| 2135 | | | |
| 2136 | | | function_type = tvb_get_guint8(tvb, offset); |
| 2137 | | | |
| 2138 | | | function_type_item = proto_tree_add_item( |
| 2139 | | | wimaxasncp_tree, hf_wimaxasncp_function_type, |
| 2140 | | | tvb, offset, 1, FALSE); |
| 2141 | | | |
| 2142 | | | |
| 2143 | | | if (strcmp(val_to_str(function_type, |
| 2144 | | | wimaxasncp_function_type_vals, |
| 2145 | | | unknown), |
| 2146 | | | unknown) == 0) |
Event 8:
Skipping " if". strcmp(...) == 0 evaluates to false.
hide
|
|
| 2147 | | | { |
| 2148 | | | expert_add_info_format(pinfo, function_type_item, |
| 2149 | | | PI_UNDECODED, PI_WARN, |
| 2150 | | | "Unknown function type (%u)", |
| 2151 | | | function_type); |
| 2152 | | | } |
| 2153 | | | |
| 2154 | | | offset += 1; |
| 2155 | | | |
| 2156 | | | |
| 2157 | | | |
| 2158 | | | |
| 2159 | | | |
| 2160 | | | |
| 2161 | | | ui8 = tvb_get_guint8(tvb, offset); |
| 2162 | | | |
| 2163 | | | |
| 2164 | | | |
| 2165 | | | |
| 2166 | | | |
| 2167 | | | |
| 2168 | | | |
| 2169 | | | item = proto_tree_add_uint_format( |
| 2170 | | | wimaxasncp_tree, hf_wimaxasncp_op_id, |
| 2171 | | | tvb, offset, 1, ui8, |
| 2172 | | | "OP ID: %s", val_to_str(ui8 >> 5, wimaxasncp_op_id_vals, unknown)); |
| 2173 | | | |
| 2174 | | | proto_item_append_text( |
| 2175 | | | item, " (%s)", decode_numeric_bitfield(ui8, 0xe0, 8, "%u")); |
| 2176 | | | |
| 2177 | | | |
| 2178 | | | |
| 2179 | | | for (i = 0; i < array_length(wimaxasncp_func_to_msg_vals_map); ++i) |
Event 10:
Continuing from loop body. Entering loop body. i < sizeof( wimaxasncp_func_to_msg_vals_map ) / sizeof( wimaxasncp_func_to_msg_vals_map[0] ) evaluates to true.
hide
|
|
| 2180 | | | { |
| 2181 | | | p = &wimaxasncp_func_to_msg_vals_map[i]; |
| 2182 | | | |
| 2183 | | | if (function_type == p->function_type) |
Event 11:
Taking true branch. function_type == p->function_type evaluates to true.
hide
|
|
| 2184 | | | { |
| 2185 | | | break; |
| 2186 | | | } |
| 2187 | | | } |
| 2188 | | | |
| 2189 | | | |
| 2190 | | | |
| 2191 | | | |
| 2192 | | | |
| 2193 | | | |
| 2194 | | | message_name = p ? val_to_str(0x1f & ui8, p->vals, unknown) : unknown; |
Null Test After Dereference
This code tests the nullness of p, which has already been dereferenced. - If p were null, there would have been a prior null pointer dereference at packet-wimaxasncp.c:2183, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 12. Show: All events | Only primary events |
|
| 2195 | | | |
| 2196 | | | item = proto_tree_add_uint_format( |
| 2197 | | | wimaxasncp_tree, hf_wimaxasncp_op_id, |
| 2198 | | | tvb, offset, 1, ui8, |
| 2199 | | | "Message Type: %s", message_name); |
| 2200 | | | |
| 2201 | | | proto_item_append_text( |
| 2202 | | | item, " (%s)", decode_numeric_bitfield(ui8, 0x1f, 8, "%u")); |
| 2203 | | | |
| 2204 | | | |
| 2205 | | | if (strcmp(message_name, unknown) == 0) |
| 2206 | | | { |
| 2207 | | | expert_add_info_format(pinfo, item, |
| 2208 | | | PI_UNDECODED, PI_WARN, |
| 2209 | | | "Unknown message op (%u)", |
| 2210 | | | 0x1f & ui8); |
| 2211 | | | } |
| 2212 | | | |
| 2213 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
| 2214 | | | { |
| 2215 | | | col_add_str(pinfo->cinfo, COL_INFO, message_name); |
| 2216 | | | } |
| 2217 | | | |
| 2218 | | | offset += 1; |
| 2219 | | | |
| 2220 | | | |
| 2221 | | | |
| 2222 | | | |
| 2223 | | | |
| 2224 | | | |
| 2225 | | | length = tvb_get_ntohs(tvb, offset); |
| 2226 | | | |
| 2227 | | | if (tree) |
| 2228 | | | { |
| 2229 | | | proto_item_set_len( |
| 2230 | | | packet_item, MAX(, length));
x /usr/include/glib-2.0/glib/gmacros.h |
| |
198 | #define MAX(a, b) (((a) > (b)) ? (a) : (b)) |
| |
|
| 2231 | | | |
| 2232 | | | item = proto_tree_add_uint( |
| 2233 | | | wimaxasncp_tree, hf_wimaxasncp_length, |
| 2234 | | | tvb, offset, 2, length); |
| 2235 | | | } |
| 2236 | | | |
| 2237 | | | offset += 2; |
| 2238 | | | |
| 2239 | | | if (length < ) |
| 2240 | | | { |
| 2241 | | | expert_add_info_format( |
| 2242 | | | pinfo, item, PI_MALFORMED, PI_ERROR, "Bad length"); |
| 2243 | | | |
| 2244 | | | if (tree) |
| 2245 | | | { |
| 2246 | | | proto_item_append_text( |
| 2247 | | | item, " [error: specified length less than size (20)]"); |
| 2248 | | | } |
| 2249 | | | |
| 2250 | | | if (length <= ) |
| 2251 | | | { |
| 2252 | | | return offset; |
| 2253 | | | } |
| 2254 | | | } |
| 2255 | | | |
| 2256 | | | |
| 2257 | | | |
| 2258 | | | |
| 2259 | | | |
| 2260 | | | |
| 2261 | | | subtree = tvb_new_subset( |
| 2262 | | | tvb, offset, |
| 2263 | | | MIN(length, tvb_length(tvb) - offset),
x /usr/include/glib-2.0/glib/gmacros.h |
| |
201 | #define MIN(a, b) (((a) < (b)) ? (a) : (b)) |
| |
|
| 2264 | | | length - ); |
| 2265 | | | |
| 2266 | | | offset += dissect_wimaxasncp_backend( |
| 2267 | | | subtree, pinfo, wimaxasncp_tree); |
| 2268 | | | |
| 2269 | | | |
| 2270 | | | |
| 2271 | | | |
| 2272 | | | |
| 2273 | | | |
| 2274 | | | return offset; |
| 2275 | | | } |
| |