(/home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/wimax/packet-wmx.c) |
| |
| 640 | | | proto_tree *add_tlv_subtree(tlv_info_t *this, gint idx, proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, gboolean little_endian) |
| 641 | | | { |
| 642 | | | |
| 643 | | | proto_tree *tlv_tree; |
| 644 | | | proto_item *tlv_item; |
| 645 | | | guint start_of_tlv; |
| 646 | | | gint tlv_value_length, tlv_val_offset; |
| 647 | | | guint8 size_of_tlv_length_field; |
| 648 | | | guint8 tlv_type; |
| 649 | | | guint32 tlv_value; |
| 650 | | | gchar *hex_fmt; |
| 651 | | | |
| 652 | | | UNREFERENCED_PARAMETER(length); |
| 653 | | | |
| 654 | | | |
| 655 | | | tlv_val_offset = get_tlv_value_offset(this); |
| 656 | | | start_of_tlv = start - tlv_val_offset; |
| 657 | | | tlv_value_length = get_tlv_length(this); |
| 658 | | | size_of_tlv_length_field = get_tlv_size_of_length(this); |
| 659 | | | tlv_type = get_tlv_type(this); |
| 660 | | | |
| 661 | | | |
| 662 | | | tlv_item = proto_tree_add_item(tree, hfindex, tvb, start, tlv_value_length, little_endian); |
| 663 | | | |
| 664 | | | tlv_item->finfo->start -= tlv_val_offset; |
| 665 | | | tlv_item->finfo->length += tlv_val_offset; |
| 666 | | | |
| 667 | | | tlv_tree = proto_item_add_subtree(tlv_item, *ett_tlv[tlv_type]); |
| 668 | | | |
| 669 | | | proto_tree_add_text(tlv_tree, tvb, start_of_tlv, 1, "TLV type: %u", tlv_type); |
| 670 | | | |
| 671 | | | if (size_of_tlv_length_field > 0) |
| 672 | | | { |
| 673 | | | |
| 674 | | | proto_tree_add_text(tlv_tree, tvb, start_of_tlv+1, 1, "Size of TLV length field: %u", size_of_tlv_length_field); |
| 675 | | | |
| 676 | | | proto_tree_add_text(tlv_tree, tvb, start_of_tlv+2, size_of_tlv_length_field, "TLV length: %u", tlv_value_length); |
| 677 | | | } else { |
| 678 | | | |
| 679 | | | proto_tree_add_text(tlv_tree, tvb, start_of_tlv+1, 1, "TLV length: %u", tlv_value_length); |
| 680 | | | } |
| 681 | | | |
| 682 | | | switch (tlv_value_length) |
| 683 | | | { |
| 684 | | | case 1: |
| 685 | | | tlv_value = tvb_get_guint8(tvb, start); |
| 686 | | | hex_fmt = tlv_val_1byte; |
| 687 | | | break; |
| 688 | | | case 2: |
| 689 | | | tlv_value = tvb_get_ntohs(tvb, start); |
| 690 | | | hex_fmt = tlv_val_2byte; |
| 691 | | | break; |
| 692 | | | case 3: |
| 693 | | | tlv_value = tvb_get_ntoh24(tvb, start); |
| 694 | | | hex_fmt = tlv_val_3byte; |
| 695 | | | break; |
| 696 | | | case 4: |
| 697 | | | tlv_value = tvb_get_ntohl(tvb, start); |
| 698 | | | hex_fmt = tlv_val_4byte; |
| 699 | | | break; |
| 700 | | | default: |
| 701 | | | tlv_value = tvb_get_ntohl(tvb, start); |
| 702 | | | hex_fmt = tlv_val_5byte; |
| 703 | | | break; |
| 704 | | | } |
| 705 | | | |
| 706 | | | tlv_item = proto_tree_add_text(tlv_tree, tvb, start, tlv_value_length, hex_fmt, tlv_item->finfo->hfinfo->name, tlv_value); |
Format String
proto_tree_add_text() is being called with a format string that is not constant. The format string (fifth argument) may not match the other arguments to proto_tree_add_text(); this could lead to security or stability problems. proto_tree_add_text() is usually called with strings that look like format strings in this project. |
|
| 707 | | | tlv_tree = proto_item_add_subtree(tlv_item, idx); |
| 708 | | | |
| 709 | | | |
| 710 | | | return tlv_tree; |
| 711 | | | } |
| |