(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-mq.c) |
| |
| 1230 | | | dissect_mq_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) |
| 1231 | | | { |
| 1232 | | | proto_tree *mq_tree = NULL; |
| 1233 | | | proto_tree *mqroot_tree = NULL; |
| 1234 | | | proto_item *ti = NULL; |
| 1235 | | | gint offset = 0; |
| 1236 | | | guint32 structId = MQ_STRUCTID_NULL; |
| 1237 | | | guint8 opcode; |
| 1238 | | | guint32 iSegmentLength = 0; |
| 1239 | | | guint32 iSizePayload = 0; |
| 1240 | | | gint iSizeMD = 0; |
| 1241 | | | gboolean bLittleEndian = FALSE; |
| 1242 | | | gboolean bPayload = FALSE; |
| 1243 | | | gboolean bEBCDIC = FALSE; |
| 1244 | | | gint iDistributionListSize = 0; |
| 1245 | | | struct mq_msg_properties tMsgProps; |
| 1246 | | | static gint = -1; |
| 1247 | | | |
| 1248 | | | if (check_col(pinfo->cinfo, COL_PROTOCOL)) col_set_str(pinfo->cinfo, COL_PROTOCOL, "MQ"); |
Event 1:
Taking true branch. check_col(...) evaluates to true.
hide
|
|
| 1249 | [+] | | if (check_col(pinfo->cinfo, COL_INFO)) |
 |
| 1250 | | | { |
| 1251 | | | |
| 1252 | | | if ( != (gint) pinfo->fd->num) |
| 1253 | | | col_clear(pinfo->cinfo, COL_INFO); |
| 1254 | | | else |
| 1255 | | | col_append_str(pinfo->cinfo, COL_INFO, " | "); |
| 1256 | | | } |
| 1257 | | | = pinfo->fd->num; |
| 1258 | | | if (tvb_length(tvb) >= 4) |
Event 5:
Taking true branch. tvb_length(tvb) >= 4 evaluates to true.
hide
|
|
| 1259 | | | { |
| 1260 | [+] | | structId = tvb_get_ntohl(tvb, offset); |
 |
| 1261 | [+] | | if ((structId == MQ_STRUCTID_TSH || structId == MQ_STRUCTID_TSH_EBCDIC) && tvb_length_remaining(tvb, offset) >= 28) |
Event 13:
Skipping " if". - structId == 1414744096 evaluates to false.
- structId == 3823290432 evaluates to true.
hide
|
|
 |
| 1262 | | | { |
| 1263 | | | |
| 1264 | | | gint iSizeTSH = 28; |
| 1265 | | | guint8 iControlFlags = 0; |
| 1266 | | | if (structId == MQ_STRUCTID_TSH_EBCDIC) bEBCDIC = TRUE; |
Event 26:
Skipping " if". structId == 3823290432 evaluates to false.
hide
|
|
| 1267 | [+] | | opcode = tvb_get_guint8(tvb, offset + 9); |
 |
| 1268 | [+] | | bLittleEndian = (tvb_get_guint8(tvb, offset + 8) == MQ_LITTLE_ENDIAN ? TRUE : FALSE); |
 |
| 1269 | | | iSegmentLength = tvb_get_ntohl(tvb, offset + 4); |
| 1270 | | | iControlFlags = tvb_get_guint8(tvb, offset + 10); |
| 1271 | | | |
| 1272 | [+] | | if (check_col(pinfo->cinfo, COL_INFO)) |
 |
| 1273 | | | { |
| 1274 | | | col_append_str(pinfo->cinfo, COL_INFO, val_to_str(opcode, mq_opcode_vals, "Unknown (0x%02x)")); |
| 1275 | | | } |
| 1276 | | | |
| 1277 | | | if (tree) |
Event 45:
Skipping " if". tree evaluates to false.
hide
|
|
| 1278 | | | { |
| 1279 | | | ti = proto_tree_add_item(tree, proto_mq, tvb, offset, -1, FALSE); |
| 1280 | | | proto_item_append_text(ti, " (%s)", val_to_str(opcode, mq_opcode_vals, "Unknown (0x%02x)")); |
| 1281 | | | if (bEBCDIC == TRUE) proto_item_append_text(ti, " (EBCDIC)"); |
| 1282 | | | mqroot_tree = proto_item_add_subtree(ti, ett_mq); |
| 1283 | | | |
| 1284 | | | ti = proto_tree_add_text(mqroot_tree, tvb, offset, iSizeTSH, MQ_TEXT_TSH); |
| 1285 | | | mq_tree = proto_item_add_subtree(ti, ett_mq_tsh); |
| 1286 | | | |
| 1287 | | | proto_tree_add_item(mq_tree, hf_mq_tsh_structid, tvb, offset + 0, 4, FALSE); |
| 1288 1306 |  | | [ Lines 1288 to 1306 omitted. ] |
| 1307 | | | proto_tree_add_boolean(mq_tree_sub, hf_mq_tsh_tcf_error, tvb, offset + 10, 1, iControlFlags); |
| 1308 | | | proto_tree_add_boolean(mq_tree_sub, hf_mq_tsh_tcf_confirmreq, tvb, offset + 10, 1, iControlFlags); |
| 1309 | | | } |
| 1310 | | | |
| 1311 | | | proto_tree_add_item(mq_tree, hf_mq_tsh_reserved, tvb, offset + 11, 1, FALSE); |
| 1312 | | | proto_tree_add_item(mq_tree, hf_mq_tsh_luwid, tvb, offset + 12, 8, FALSE); |
| 1313 | | | proto_tree_add_item(mq_tree, hf_mq_tsh_encoding, tvb, offset + 20, 4, bLittleEndian); |
| 1314 | | | proto_tree_add_item(mq_tree, hf_mq_tsh_ccsid, tvb, offset + 24, 2, bLittleEndian); |
| 1315 | | | proto_tree_add_item(mq_tree, hf_mq_tsh_padding, tvb, offset + 26, 2, FALSE); |
| 1316 | | | } |
| 1317 | | | offset += iSizeTSH; |
| 1318 | | | |
| 1319 | | | |
| 1320 | [+] | | if (tvb_length_remaining(tvb, offset) >= 4) |
 |
| 1321 | | | { |
| 1322 | | | structId = tvb_get_ntohl(tvb, offset); |
| 1323 | | | if (((iControlFlags & MQ_TCF_FIRST) != 0) || opcode < 0x80) |
Event 58:
Taking true branch. (iControlFlags & 16) != 0 evaluates to true.
hide
|
|
| 1324 | | | { |
| 1325 | | | |
| 1326 | | | gint iSizeAPI = 16; |
| 1327 | | | if (opcode >= 0x80 && opcode <= 0x9F && tvb_length_remaining(tvb, offset) >= 16) |
| 1328 | | | { |
| 1329 | | | guint32 iReturnCode = 0; |
| 1330 | | | iReturnCode = tvb_get_guint32_endian(tvb, offset + 8, bLittleEndian); |
| 1331 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
Event 60:
Taking true branch. check_col(...) evaluates to true.
hide
|
|
| 1332 | | | { |
| 1333 | | | if (iReturnCode != 0) |
Event 61:
Taking true branch. iReturnCode != 0 evaluates to true.
hide
|
|
| 1334 | | | col_append_fstr(pinfo->cinfo, COL_INFO, " [RC=%d]", iReturnCode); |
| 1335 | | | } |
| 1336 | | | |
| 1337 | | | if (tree) |
Event 62:
Skipping " if". tree evaluates to false.
hide
|
|
| 1338 | | | { |
| 1339 | | | ti = proto_tree_add_text(mqroot_tree, tvb, offset, iSizeAPI, MQ_TEXT_API); |
| 1340 | | | mq_tree = proto_item_add_subtree(ti, ett_mq_api); |
| 1341 | | | |
| 1342 | | | proto_tree_add_item(mq_tree, hf_mq_api_replylength, tvb, offset, 4, FALSE); |
| 1343 | | | proto_tree_add_item(mq_tree, hf_mq_api_completioncode, tvb, offset + 4, 4, bLittleEndian); |
| 1344 | | | proto_tree_add_item(mq_tree, hf_mq_api_reasoncode, tvb, offset + 8, 4, bLittleEndian); |
| 1345 | | | proto_tree_add_item(mq_tree, hf_mq_api_objecthandle, tvb, offset + 12, 4, bLittleEndian); |
| 1346 | | | } |
| 1347 | | | offset += iSizeAPI; |
| 1348 | | | structId = (tvb_length_remaining(tvb, offset) >= 4) ? tvb_get_ntohl(tvb, offset) : MQ_STRUCTID_NULL; |
Event 63:
tvb_length_remaining(...) >= 4 evaluates to false.
hide
|
|
| 1349 | | | } |
| 1350 | | | if ((structId == MQ_STRUCTID_MSH || structId == MQ_STRUCTID_MSH_EBCDIC) && tvb_length_remaining(tvb, offset) >= 20) |
| 1351 | | | { |
| 1352 | | | gint iSizeMSH = 20; |
| 1353 | [+] | | iSizePayload = tvb_get_guint32_endian(tvb, offset + 16, bLittleEndian); |
 |
| 1354 | | | bPayload = TRUE; |
Event 66:
!0 evaluates to true.
hide
|
|
| 1355 | | | if (tree) |
Event 67:
Skipping " if". tree evaluates to false.
hide
|
|
| 1356 | | | { |
| 1357 | | | ti = proto_tree_add_text(mqroot_tree, tvb, offset, iSizeMSH, MQ_TEXT_MSH); |
| 1358 | | | mq_tree = proto_item_add_subtree(ti, ett_mq_msh); |
| 1359 | | | |
| 1360 | | | proto_tree_add_item(mq_tree, hf_mq_msh_structid, tvb, offset + 0, 4, FALSE); |
| 1361 | | | proto_tree_add_item(mq_tree, hf_mq_msh_seqnum, tvb, offset + 4, 4, bLittleEndian); |
| 1362 | | | proto_tree_add_item(mq_tree, hf_mq_msh_datalength, tvb, offset + 8, 4, bLittleEndian); |
| 1363 | | | proto_tree_add_item(mq_tree, hf_mq_msh_unknown1, tvb, offset + 12, 4, bLittleEndian); |
| 1364 | | | proto_tree_add_item(mq_tree, hf_mq_msh_msglength, tvb, offset + 16, 4, bLittleEndian); |
| 1365 | | | } |
| 1366 | | | offset += iSizeMSH; |
| 1367 | | | } |
| 1368 | | | else if (opcode == MQ_TST_STATUS && tvb_length_remaining(tvb, offset) >= 8) |
| 1369 | | | { |
| 1370 | | | |
| 1371 | | | guint32 iStatus = 0; |
| 1372 | | | gint iStatusLength = 0; |
| 1373 | | | iStatus = tvb_get_guint32_endian(tvb, offset + 4, bLittleEndian); |
| 1374 | | | iStatusLength = tvb_get_guint32_endian(tvb, offset, bLittleEndian); |
| 1375 | | | |
| 1376 | | | if (tvb_length_remaining(tvb, offset) >= iStatusLength) |
| 1377 1903 |  | | [ Lines 1377 to 1903 omitted. ] |
| 1904 | | | { |
| 1905 | | | if (tree) |
| 1906 | | | { |
| 1907 | | | proto_tree_add_item(mq_tree, hf_mq_uid_longuserid, tvb, offset + 28, 64, FALSE); |
| 1908 | | | proto_tree_add_item(mq_tree, hf_mq_uid_securityid, tvb, offset + 92, 40, FALSE); |
| 1909 | | | } |
| 1910 | | | } |
| 1911 | | | offset += iSizeUID; |
| 1912 | | | } |
| 1913 | | | } |
| 1914 | [+] | | if ((structId == MQ_STRUCTID_OD || structId == MQ_STRUCTID_OD_EBCDIC) && tvb_length_remaining(tvb, offset) >= 8) |
Event 68:
Skipping " if". - structId == 1329864736 evaluates to false.
- structId == 3603185728 evaluates to true.
hide
|
|
 |
| 1915 | | | { |
| 1916 | | | |
| 1917 | | | gint iSizeOD = 0; |
| 1918 | | | guint32 iVersionOD = 0; |
| 1919 | | | iVersionOD = tvb_get_guint32_endian(tvb, offset + 4, bLittleEndian); |
| 1920 | | | |
| 1921 | | | switch (iVersionOD) |
| 1922 | | | { |
| 1923 | | | case 1: iSizeOD = 168; break; |
| 1924 | | | case 2: iSizeOD = 200; break; |
| 1925 1985 |  | | [ Lines 1925 to 1985 omitted. ] |
| 1986 | | | iOffsetOR = tvb_get_guint32_endian(tvb, offset - iSizeOD + 184, bLittleEndian); |
| 1987 | | | iOffsetRR = tvb_get_guint32_endian(tvb, offset - iSizeOD + 188, bLittleEndian); |
| 1988 | | | if ((iSizeORRR = dissect_mq_or(tvb, mqroot_tree, offset, iNbrRecords, iOffsetOR)) != 0) |
| 1989 | | | offset += iSizeORRR; |
| 1990 | | | if ((iSizeORRR = dissect_mq_rr(tvb, mqroot_tree, bLittleEndian, offset, iNbrRecords, iOffsetRR)) != 0) |
| 1991 | | | offset += iSizeORRR; |
| 1992 | | | } |
| 1993 | | | } |
| 1994 | | | structId = (tvb_length_remaining(tvb, offset) >= 4) ? tvb_get_ntohl(tvb, offset) : MQ_STRUCTID_NULL; |
| 1995 | | | } |
| 1996 | | | if ((opcode == MQ_TST_MQOPEN || opcode == MQ_TST_MQCLOSE |
Event 81:
Skipping " if". opcode == 131 evaluates to true.
hide
|
|
| 1997 | | | || opcode == MQ_TST_MQOPEN_REPLY || opcode == MQ_TST_MQCLOSE_REPLY) |
| 1998 | [+] | | && tvb_length_remaining(tvb, offset) >= 4) |
 |
| 1999 | | | { |
| 2000 | | | if (tree) |
| 2001 | | | { |
| 2002 | | | ti = proto_tree_add_text(mqroot_tree, tvb, offset, 4, MQ_TEXT_OPEN); |
| 2003 | | | mq_tree = proto_item_add_subtree(ti, ett_mq_open); |
| 2004 | | | proto_tree_add_item(mq_tree, hf_mq_open_options, tvb, offset, 4, bLittleEndian); |
| 2005 | | | } |
| 2006 | | | offset += 4; |
| 2007 | | | structId = (tvb_length_remaining(tvb, offset) >= 4) ? tvb_get_ntohl(tvb, offset) : MQ_STRUCTID_NULL; |
| 2008 | | | } |
| 2009 | [+] | | if ((iSizeMD = dissect_mq_md(tvb, mqroot_tree, bLittleEndian, offset, &tMsgProps)) != 0) |
Event 94:
dissect_mq_md() does not initialize tMsgProps. - This may be because of a failure case or other special case for dissect_mq_md().
hide
|
|
 |
| 2010 | | | { |
| 2011 | | | gint iSizeGMO = 0; |
| 2012 | | | gint iSizePMO = 0; |
| 2013 | | | offset += iSizeMD; |
| 2014 | | | |
| 2015 | | | if ((iSizeGMO = dissect_mq_gmo(tvb, pinfo, mqroot_tree, bLittleEndian, offset)) != 0) |
| 2016 | | | { |
| 2017 | | | offset += iSizeGMO; |
| 2018 | | | bPayload = TRUE; |
| 2019 | | | } |
| 2020 2029 |  | | [ Lines 2020 to 2029 omitted. ] |
| 2030 | | | if (tree) |
| 2031 | | | { |
| 2032 | | | ti = proto_tree_add_text(mqroot_tree, tvb, offset, 4, MQ_TEXT_PUT); |
| 2033 | | | mq_tree = proto_item_add_subtree(ti, ett_mq_put); |
| 2034 | | | proto_tree_add_item(mq_tree, hf_mq_put_length, tvb, offset, 4, bLittleEndian); |
| 2035 | | | } |
| 2036 | | | offset += 4; |
| 2037 | | | } |
| 2038 | | | } |
| 2039 | | | } |
| 2040 | | | if (iDistributionListSize > 0) |
Event 97:
Skipping " if". iDistributionListSize > 0 evaluates to false.
hide
|
|
| 2041 | | | { |
| 2042 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
| 2043 | | | col_append_fstr(pinfo->cinfo, COL_INFO, " (Distribution List, Size=%d)", iDistributionListSize); |
| 2044 | | | } |
| 2045 | | | if (bPayload == TRUE) |
Event 98:
Skipping " if". !0 evaluates to true.
hide
Event 99:
Taking true branch. bPayload == !0 evaluates to true.
hide
|
|
| 2046 | | | { |
| 2047 | [+] | | if (iSizePayload != 0 && tvb_length_remaining(tvb, offset) > 0) |
Event 100:
Skipping " if". iSizePayload != 0 evaluates to true.
hide
|
|
 |
| 2048 | | | { |
| 2049 | | | |
| 2050 | | | |
| 2051 | | | |
| 2052 | | | guint32 = 0; |
| 2053 | | | if (tvb_length_remaining(tvb, offset) >= 4) |
Event 113:
Skipping " if". tvb_length_remaining(...) >= 4 evaluates to false.
hide
|
|
| 2054 | | | { |
| 2055 | | | gint iSizeMD = 0; |
| 2056 | | | structId = tvb_get_ntohl(tvb, offset); |
| 2057 | | | |
| 2058 | | | if ((structId == MQ_STRUCTID_XQH || structId == MQ_STRUCTID_XQH_EBCDIC) && tvb_length_remaining(tvb, offset) >= 104) |
| 2059 | | | { |
| 2060 | | | |
| 2061 | | | gint iSizeXQH = 104; |
| 2062 | | | if (tree) |
| 2063 | | | { |
| 2064 2228 |  | | [ Lines 2064 to 2228 omitted. ] |
| 2229 | | | proto_tree_add_item(mq_tree, hf_mq_head_struct, tvb, offset + 32, - 32, bLittleEndian); |
| 2230 | | | |
| 2231 | | | } |
| 2232 | | | offset += ; |
| 2233 | | | += ; |
| 2234 | | | structId = (tvb_length_remaining(tvb, offset) >= 4) ? tvb_get_ntohl(tvb, offset) : MQ_STRUCTID_NULL; |
| 2235 | | | } |
| 2236 | | | } |
| 2237 | | | } |
| 2238 | | | |
| 2239 | | | if (tMsgProps.iOffsetFormat != 0) |
Uninitialized Variable
tMsgProps was not initialized. The issue can occur if the highlighted code executes. See related event 94. Show: All events | Only primary events |
|
| |