(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-gsm_a_dtap.c) |
| |
| 5484 | | | dissect_dtap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) |
| 5485 | | | { |
| 5486 | | | static gsm_a_tap_rec_t tap_rec[4]; |
| 5487 | | | static gsm_a_tap_rec_t *tap_p; |
| 5488 | | | static guint tap_current=0; |
| 5489 | | | void (*msg_fcn)(tvbuff_t *tvb, proto_tree *tree, guint32 offset, guint len); |
| 5490 | | | guint8 oct; |
| 5491 | | | guint8 pd; |
| 5492 | | | guint32 offset; |
| 5493 | | | guint32 len; |
| 5494 | | | guint32 oct_1, oct_2; |
| 5495 | | | gint idx; |
| 5496 | | | proto_item *dtap_item = NULL; |
| 5497 | | | proto_tree *dtap_tree = NULL; |
| 5498 | | | proto_item *oct_1_item = NULL; |
| 5499 | | | proto_tree *pd_tree = NULL; |
| 5500 | | | const gchar *msg_str; |
| 5501 | | | gint ett_tree; |
| 5502 | | | gint ti; |
| 5503 | | | int hf_idx; |
| 5504 | | | gboolean nsd; |
| 5505 | | | |
| 5506 | | | |
| 5507 | | | len = tvb_length(tvb); |
| 5508 | | | |
| 5509 | | | if (len < 2) |
Event 1:
Skipping " if". len < 2 evaluates to false.
hide
|
|
| 5510 | | | { |
| 5511 | | | |
| 5512 | | | |
| 5513 | | | |
| 5514 | | | call_dissector(data_handle, tvb, pinfo, tree); |
| 5515 | | | return; |
| 5516 | | | } |
| 5517 | | | |
| 5518 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
Event 2:
Skipping " if". check_col(...) evaluates to false.
hide
|
|
| 5519 | | | { |
| 5520 | | | col_append_str(pinfo->cinfo, COL_INFO, "(DTAP) "); |
| 5521 | | | } |
| 5522 | | | |
| 5523 | | | |
| 5524 | | | |
| 5525 | | | |
| 5526 | | | tap_current++; |
| 5527 | | | if (tap_current >= 4) |
Event 3:
Skipping " if". tap_current >= 4 evaluates to false.
hide
|
|
| 5528 | | | { |
| 5529 | | | tap_current = 0; |
| 5530 | | | } |
| 5531 | | | tap_p = &tap_rec[tap_current]; |
| 5532 | | | |
| 5533 | | | |
| 5534 | | | offset = 0; |
| 5535 | | | oct_2 = 0; |
| 5536 | | | |
| 5537 | | | gsm_a_dtap_pinfo = pinfo; |
| 5538 | | | g_tree = tree; |
| 5539 | | | |
| 5540 | | | |
| 5541 | | | |
| 5542 | | | |
| 5543 | | | oct_1 = tvb_get_guint8(tvb, offset++); |
| 5544 | | | |
| 5545 | | | if ((((oct_1 & DTAP_TI_MASK) >> 4) & DTAP_TIE_PRES_MASK) == DTAP_TIE_PRES_MASK) |
Event 4:
Skipping " if". ((oct_1 & 240) >> 4 & 7) == 7 evaluates to false.
hide
|
|
| 5546 | | | { |
| 5547 | | | |
| 5548 | | | |
| 5549 | | | |
| 5550 | | | |
| 5551 | | | |
| 5552 | | | oct_2 = tvb_get_guint8(tvb, offset++); |
| 5553 | | | } |
| 5554 | | | |
| 5555 | | | oct = tvb_get_guint8(tvb, offset); |
| 5556 | | | |
| 5557 | | | pd = oct_1 & DTAP_PD_MASK; |
| 5558 | | | ti = -1; |
| 5559 | | | msg_str = NULL; |
| 5560 | | | ett_tree = -1; |
| 5561 | | | hf_idx = -1; |
| 5562 | | | msg_fcn = NULL; |
| 5563 | | | nsd = FALSE; |
| 5564 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
Event 5:
Skipping " if". check_col(...) evaluates to false.
hide
|
|
| 5565 | | | { |
| 5566 | | | col_append_fstr(pinfo->cinfo, COL_INFO, "(%s) ",val_to_str(pd,gsm_a_pd_short_str_vals,"unknown")); |
| 5567 | | | } |
| 5568 | | | |
| 5569 | | | |
| 5570 | | | |
| 5571 | | | |
| 5572 | | | switch (pd) |
Event 6:
pd evaluates to 6.
hide
|
|
| 5573 | | | { |
| 5574 | | | case 3: |
| 5575 | | | msg_str = match_strval_idx((guint32) (oct & DTAP_CC_IEI_MASK), gsm_a_dtap_msg_cc_strings, &idx); |
| 5576 | | | ett_tree = ett_gsm_dtap_msg_cc[idx]; |
| 5577 | | | hf_idx = hf_gsm_a_dtap_msg_cc_type; |
| 5578 | | | msg_fcn = dtap_msg_cc_fcn[idx]; |
| 5579 | | | ti = (oct_1 & DTAP_TI_MASK) >> 4; |
| 5580 | | | nsd = TRUE; |
| 5581 | | | break; |
| 5582 | | | |
| 5583 | | | case 5: |
| 5584 | | | msg_str = match_strval_idx((guint32) (oct & DTAP_MM_IEI_MASK), gsm_a_dtap_msg_mm_strings, &idx); |
| 5585 | | | ett_tree = ett_gsm_dtap_msg_mm[idx]; |
| 5586 | | | hf_idx = hf_gsm_a_dtap_msg_mm_type; |
| 5587 | | | msg_fcn = dtap_msg_mm_fcn[idx]; |
| 5588 | | | nsd = TRUE; |
| 5589 | | | break; |
| 5590 | | | |
| 5591 | | | case 6: |
| 5592 | | | get_rr_msg_params(oct, &msg_str, &ett_tree, &hf_idx, &msg_fcn); |
| 5593 | | | break; |
| 5594 | | | |
| 5595 | | | case 8: |
| 5596 | | | get_gmm_msg_params(oct, &msg_str, &ett_tree, &hf_idx, &msg_fcn); |
| 5597 | | | break; |
| 5598 | | | |
| 5599 | | | case 9: |
| 5600 | | | msg_str = match_strval_idx((guint32) (oct & DTAP_SMS_IEI_MASK), gsm_a_dtap_msg_sms_strings, &idx); |
| 5601 | | | ett_tree = ett_gsm_dtap_msg_sms[idx]; |
| 5602 | | | hf_idx = hf_gsm_a_dtap_msg_sms_type; |
| 5603 | | | msg_fcn = dtap_msg_sms_fcn[idx]; |
| 5604 | | | ti = (oct_1 & DTAP_TI_MASK) >> 4; |
| 5605 | | | break; |
| 5606 | | | |
| 5607 | | | case 10: |
| 5608 | | | get_sm_msg_params(oct, &msg_str, &ett_tree, &hf_idx, &msg_fcn); |
| 5609 | | | ti = (oct_1 & DTAP_TI_MASK) >> 4; |
| 5610 | | | break; |
| 5611 | | | |
| 5612 | | | case 11: |
| 5613 | | | msg_str = match_strval_idx((guint32) (oct & DTAP_SS_IEI_MASK), gsm_a_dtap_msg_ss_strings, &idx); |
| 5614 | | | ett_tree = ett_gsm_dtap_msg_ss[idx]; |
| 5615 | | | hf_idx = hf_gsm_a_dtap_msg_ss_type; |
| 5616 | | | msg_fcn = dtap_msg_ss_fcn[idx]; |
| 5617 | | | ti = (oct_1 & DTAP_TI_MASK) >> 4; |
| 5618 | | | nsd = TRUE; |
| 5619 | | | break; |
| 5620 | | | |
| 5621 | | | case 15: |
| 5622 | | | msg_str = match_strval_idx((guint32) (oct & DTAP_TP_IEI_MASK), gsm_a_dtap_msg_tp_strings, &idx); |
| 5623 | | | ett_tree = ett_gsm_dtap_msg_tp[idx]; |
| 5624 | | | hf_idx = hf_gsm_a_dtap_msg_tp_type; |
| 5625 | | | msg_fcn = dtap_msg_tp_fcn[idx]; |
| 5626 | | | ti = (oct_1 & DTAP_TI_MASK) >> 4; |
| 5627 | | | nsd = TRUE; |
| 5628 | | | break; |
| 5629 | | | |
| 5630 | | | default: |
| 5631 | | | |
| 5632 | | | return; |
| 5633 | | | } |
| 5634 | | | |
| 5635 | | | sccp_msg = pinfo->sccp_info; |
| 5636 | | | |
| 5637 | | | if (sccp_msg && sccp_msg->data.co.assoc) { |
| 5638 | | | sccp_assoc = sccp_msg->data.co.assoc; |
| 5639 | | | } else { |
| 5640 | | | sccp_assoc = NULL; |
| 5641 | | | sccp_msg = NULL; |
| 5642 | | | } |
| 5643 | | | |
| 5644 | | | |
| 5645 | | | |
| 5646 | | | |
| 5647 | | | if (msg_str == NULL) |
Event 9:
Taking true branch. msg_str == (void *)0 evaluates to true.
hide
|
|
| 5648 | | | { |
| 5649 | | | dtap_item = |
| 5650 | | | proto_tree_add_protocol_format(tree, proto_a_dtap, tvb, 0, len, |
| 5651 | | | "GSM A-I/F DTAP - Unknown DTAP Message Type (0x%02x)", |
| 5652 | | | oct); |
| 5653 | | | |
| 5654 | | | dtap_tree = proto_item_add_subtree(dtap_item, ett_dtap_msg); |
| 5655 | | | |
| 5656 | | | if (sccp_msg && !sccp_msg->data.co.label) { |
Null Test After Dereference
This code tests the nullness of sccp_msg, which has already been dereferenced. - If sccp_msg were null, there would have been a prior null pointer dereference at packet-gsm_a_dtap.c:5638, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 8. Show: All events | Only primary events |
|
| 5657 | | | sccp_msg->data.co.label = se_strdup_printf("DTAP (0x%02x)",oct); |
| 5658 | | | } |
| 5659 | | | |
| 5660 | | | |
| 5661 | | | } |
| 5662 | | | else |
| 5663 | | | { |
| 5664 | | | dtap_item = |
| 5665 | | | proto_tree_add_protocol_format(tree, proto_a_dtap, tvb, 0, -1, |
| 5666 | | | "GSM A-I/F DTAP - %s", |
| 5667 | | | msg_str); |
| 5668 | | | |
| 5669 | | | dtap_tree = proto_item_add_subtree(dtap_item, ett_tree); |
| 5670 | | | |
| 5671 | | | if (sccp_msg && !sccp_msg->data.co.label) { |
| 5672 | | | sccp_msg->data.co.label = se_strdup(msg_str); |
| 5673 | | | } |
| 5674 | | | |
| 5675 | | | if (check_col(pinfo->cinfo, COL_INFO)) |
| 5676 | | | { |
| 5677 | | | col_append_fstr(pinfo->cinfo, COL_INFO, "%s ", msg_str); |
| 5678 | | | } |
| 5679 | | | } |
| 5680 | | | |
| 5681 | | | oct_1_item = |
| 5682 | | | proto_tree_add_text(dtap_tree, |
| 5683 | | | tvb, 0, 1, |
| 5684 | | | "Protocol Discriminator: %s", |
| 5685 | | | val_to_str(pd, protocol_discriminator_vals, "Unknown (%u)")); |
| 5686 | | | |
| 5687 | | | pd_tree = proto_item_add_subtree(oct_1_item, ett_dtap_oct_1); |
| 5688 | | | |
| 5689 | | | if (ti == -1) |
| 5690 | | | { |
| 5691 | | | proto_tree_add_item(pd_tree, hf_gsm_a_skip_ind, tvb, 0, 1, FALSE); |
| 5692 | | | } |
| 5693 | | | else |
| 5694 | | | { |
| 5695 | | | other_decode_bitfield_value(a_bigbuf, oct_1, 0x80, 8); |
| 5696 | | | proto_tree_add_text(pd_tree, |
| 5697 | | | tvb, 0, 1, |
| 5698 | | | "%s : TI flag: %s", |
| 5699 | | | a_bigbuf, |
| 5700 | | | ((oct_1 & 0x80) ? "allocated by receiver" : "allocated by sender")); |
| 5701 | | | |
| 5702 | | | if ((ti & DTAP_TIE_PRES_MASK) == DTAP_TIE_PRES_MASK) |
| 5703 | | | { |
| 5704 | | | |
| 5705 | | | |
| 5706 | | | other_decode_bitfield_value(a_bigbuf, oct_1, 0x70, 8); |
| 5707 | | | proto_tree_add_text(pd_tree, |
| 5708 | | | tvb, 0, 1, |
| 5709 | | | "%s : TIO: The TI value is given by the TIE in octet 2", |
| 5710 | | | a_bigbuf); |
| 5711 | | | } |
| 5712 | | | else |
| 5713 | | | { |
| 5714 | | | other_decode_bitfield_value(a_bigbuf, oct_1, 0x70, 8); |
| 5715 | | | proto_tree_add_text(pd_tree, |
| 5716 | | | tvb, 0, 1, |
| 5717 | | | "%s : TIO: %u", |
| 5718 | | | a_bigbuf, |
| 5719 | | | ti & DTAP_TIE_PRES_MASK); |
| 5720 | | | } |
| 5721 | | | } |
| 5722 | | | |
| 5723 | | | proto_tree_add_item(pd_tree, hf_gsm_a_L3_protocol_discriminator, tvb, 0, 1, FALSE); |
| 5724 | | | |
| 5725 | | | if ((ti != -1) && |
| 5726 | | | (ti & DTAP_TIE_PRES_MASK) == DTAP_TIE_PRES_MASK) |
| 5727 | | | { |
| 5728 | | | proto_tree_add_item(tree, hf_gsm_a_extension, tvb, 1, 1, FALSE); |
| 5729 | | | |
| 5730 | | | other_decode_bitfield_value(a_bigbuf, oct_2, DTAP_TIE_MASK, 8); |
| 5731 | | | proto_tree_add_text(pd_tree, |
| 5732 | | | tvb, 1, 1, |
| 5733 | | | "%s : TIE: %u", |
| 5734 | | | a_bigbuf, |
| 5735 | | | oct_2 & DTAP_TIE_MASK); |
| 5736 | | | } |
| 5737 | | | |
| 5738 | | | |
| 5739 | | | |
| 5740 | | | |
| 5741 | | | if ((pinfo->p2p_dir == P2P_DIR_RECV) && |
| 5742 | | | nsd) |
| 5743 | | | { |
| 5744 | | | |
| 5745 | | | } |
| 5746 | | | |
| 5747 | | | |
| 5748 | | | |
| 5749 | | | |
| 5750 | | | |
| 5751 | | | |
| 5752 | | | |
| 5753 | | | |
| 5754 | | | if((pd==5)||(pd==3)||(pd==10)){ |
| 5755 | | | proto_tree_add_item(dtap_tree, hf_gsm_a_seq_no, tvb, offset, 1, FALSE); |
| 5756 | | | } |
| 5757 | | | |
| 5758 | | | |
| 5759 | | | |
| 5760 | | | proto_tree_add_item(dtap_tree, hf_idx, tvb, offset, 1, FALSE); |
| 5761 | | | offset++; |
| 5762 | | | |
| 5763 | | | tap_p->pdu_type = GSM_A_PDU_TYPE_DTAP;
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-gsm_a_common.h |
| |
168 | #define GSM_A_PDU_TYPE_DTAP 1 /*BSSAP_PDU_TYPE_DTAP i.e. 1 - until split complete at least! */ |
| |
|
| 5764 | | | tap_p->message_type = (nsd ? (oct & 0x3f) : oct); |
| 5765 | | | tap_p->protocol_disc = pd; |
| 5766 | | | |
| 5767 | | | tap_queue_packet(gsm_a_tap, pinfo, tap_p); |
| 5768 | | | |
| 5769 | | | if (msg_str == NULL) return; |
| 5770 | | | |
| 5771 | | | if ((len - offset) <= 0) return; |
| 5772 | | | |
| 5773 | | | |
| 5774 | | | |
| 5775 | | | |
| 5776 | | | if (msg_fcn == NULL) |
| 5777 | | | { |
| 5778 | | | proto_tree_add_text(dtap_tree, |
| 5779 | | | tvb, offset, len - offset, |
| 5780 | | | "Message Elements"); |
| 5781 | | | } |
| 5782 | | | else |
| 5783 | | | { |
| 5784 | | | (*msg_fcn)(tvb, dtap_tree, offset, len - offset); |
| 5785 | | | } |
| 5786 | | | } |
| |