(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-tcp.c) |
| |
| 2320 | | | dissect_tcpopt_scps(const ip_tcp_opt *optp, tvbuff_t *tvb, |
| 2321 | | | int offset, guint optlen, packet_info *pinfo, |
| 2322 | | | proto_tree *opt_tree) |
| 2323 | | | { |
| 2324 | | | struct tcp_analysis *tcpd=NULL; |
| 2325 | | | proto_tree *field_tree = NULL; |
| 2326 | | | tcp_flow_t *flow; |
| 2327 | | | int direction; |
| 2328 | | | proto_item *tf = NULL, *hidden_item; |
| 2329 | | | gchar flags[64] = "<None>"; |
| 2330 | | | gchar *fstr[] = {"BETS", "SNACK1", "SNACK2", "COMP", "NLTS", "RESV1", "RESV2", "RESV3"}; |
| 2331 | | | gint i, bpos; |
| 2332 | | | guint8 capvector; |
| 2333 | | | guint8 connid; |
| 2334 | | | |
| 2335 | [+] | | tcpd = get_tcp_conversation_data(NULL,pinfo); |
 |
| 2336 | | | |
| 2337 | | | |
| 2338 | | | direction=CMP_ADDRESS(&pinfo->src, &pinfo->dst);
x /home/sate/Testcases/c/cve/wireshark-1.2.0/epan/address.h |
| |
78 | #define CMP_ADDRESS(addr1, addr2) \ |
79 | ( ((addr1)->type > (addr2)->type)?1: \ |
80 | ((addr1)->type < (addr2)->type)?-1: \ |
81 | ((addr1)->len > (addr2)->len) ?1: \ |
82 | ((addr1)->len < (addr2)->len) ?-1: \ |
83 | memcmp((addr1)->data, (addr2)->data, (addr1)->len)\ |
84 | ) |
| |
|
Event 6:
(&pinfo->src)->type > (&pinfo->dst)->type evaluates to true.
hide
|
|
| 2339 | | | |
| 2340 | | | |
| 2341 | | | if(direction==0) { |
Event 7:
Skipping " if". direction == 0 evaluates to false.
hide
|
|
| 2342 | | | direction= (pinfo->srcport > pinfo->destport) ? 1 : -1; |
| 2343 | | | } |
| 2344 | | | |
| 2345 | | | if(direction>=0) |
Event 8:
Taking true branch. direction >= 0 evaluates to true.
hide
|
|
| 2346 | | | flow =&(tcpd->flow1); |
Event 9:
flow is set to &tcpd->flow1, which evaluates to NULL. See related event 5.
hide
|
|
| 2347 | | | else |
| 2348 | | | flow =&(tcpd->flow2); |
| 2349 | | | |
| 2350 | | | |
| 2351 | | | |
| 2352 | | | |
| 2353 | | | |
| 2354 | | | if (optlen == 4) { |
Event 10:
Taking false branch. optlen == 4 evaluates to false.
hide
|
|
| 2355 | | | capvector = tvb_get_guint8(tvb, offset + 2); |
| 2356 | | | flags[0] = '\0'; |
| 2357 | | | |
| 2358 | | | |
| 2359 | | | for (i = 0; i < 5; i++) { |
| 2360 | | | bpos = 128 >> i; |
| 2361 | | | if (capvector & bpos) { |
| 2362 | | | if (flags[0]) { |
| 2363 | | | g_strlcat(flags, ", ", 64); |
| 2364 | | | } |
| 2365 2400 |  | | [ Lines 2365 to 2400 omitted. ] |
| 2401 | | | proto_tree_add_boolean(field_tree, hf_tcp_scpsoption_flags_resv3, tvb, |
| 2402 | | | offset + 13, 1, capvector); |
| 2403 | | | |
| 2404 | | | tcp_info_append_str(pinfo, "SCPS", flags); |
| 2405 | | | |
| 2406 | | | flow->scps_capable = 1; |
| 2407 | | | |
| 2408 | | | if (connid) |
| 2409 | | | tcp_info_append_uint(pinfo, "Connection ID", connid); |
| 2410 | | | } |
| 2411 | | | else { |
| 2412 | | | |
| 2413 | | | |
| 2414 | | | |
| 2415 | | | |
| 2416 | | | |
| 2417 | | | |
| 2418 | | | |
| 2419 | | | |
| 2420 | | | guint8 local_offset = 2; |
| 2421 | | | guint8 binding_space; |
| 2422 | | | guint8 extended_cap_length; |
| 2423 | | | |
| 2424 | | | if (flow->scps_capable != 1) { |
Null Pointer Dereference
flow is dereferenced here, but it is NULL. The issue can occur if the highlighted code executes. See related event 9. Show: All events | Only primary events |
|
| |