(/home/sate/Testcases/c/cve/wireshark-1.2.0/plugins/wimax/packet-wmx.c) |
| |
| 728 | | | proto_tree *add_protocol_subtree(tlv_info_t *this, gint idx, proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const char *format, ...) |
| 729 | | | { |
| 730 | | | |
| 731 | | | proto_tree *tlv_tree; |
| 732 | | | proto_item *tlv_item; |
| 733 | | | guint start_of_tlv; |
| 734 | | | gint tlv_value_length, tlv_val_offset; |
| 735 | | | guint8 size_of_tlv_length_field; |
| 736 | | | guint8 tlv_type; |
| 737 | | | guint32 tlv_value; |
| 738 | | | va_list ap; |
| 739 | | | gchar *message = NULL; |
| 740 | | | gchar *hex_fmt; |
| 741 | | | |
| 742 | | | |
| 743 | | | tlv_val_offset = get_tlv_value_offset(this); |
| 744 | | | start_of_tlv = start - tlv_val_offset; |
| 745 | | | tlv_value_length = get_tlv_length(this); |
| 746 | | | size_of_tlv_length_field = get_tlv_size_of_length(this); |
| 747 | | | tlv_type = get_tlv_type(this); |
| 748 | | | |
| 749 | | | |
| 750 | | | va_start(ap, format);
x /home/sate/codesonar-3.7p0/csurf/csinclude/stdarg.h |
| |
43 | #hard_define va_start(x, n) (*(char**)&(x) = (char*)(&__builtin_va_alist)) |
| |
|
| 751 | | | message = se_strdup_vprintf(format, ap); |
| 752 | | | va_end(ap); |
| 753 | | | tlv_item = proto_tree_add_protocol_format(tree, hfindex, tvb, start, length, "%s", message); |
| 754 | | | |
| 755 | | | tlv_item->finfo->start -= tlv_val_offset; |
| 756 | | | tlv_item->finfo->length += tlv_val_offset; |
| 757 | | | |
| 758 | | | tlv_tree = proto_item_add_subtree(tlv_item, *ett_tlv[tlv_type]); |
| 759 | | | |
| 760 | | | proto_tree_add_text(tlv_tree, tvb, start_of_tlv, 1, "TLV type: %u", tlv_type); |
| 761 | | | |
| 762 | | | if (size_of_tlv_length_field > 0) |
| 763 | | | { |
| 764 | | | |
| 765 | | | proto_tree_add_text(tlv_tree, tvb, start_of_tlv+1, 1, "Size of TLV length field: %u", size_of_tlv_length_field); |
| 766 | | | |
| 767 | | | proto_tree_add_text(tlv_tree, tvb, start_of_tlv+2, size_of_tlv_length_field, "TLV length: %u", tlv_value_length); |
| 768 | | | } else { |
| 769 | | | |
| 770 | | | proto_tree_add_text(tlv_tree, tvb, start_of_tlv+1, 1, "TLV length: %u", tlv_value_length); |
| 771 | | | } |
| 772 | | | |
| 773 | | | switch (tlv_value_length) |
| 774 | | | { |
| 775 | | | case 1: |
| 776 | | | tlv_value = tvb_get_guint8(tvb, start); |
| 777 | | | hex_fmt = tlv_val_1byte; |
| 778 | | | break; |
| 779 | | | case 2: |
| 780 | | | tlv_value = tvb_get_ntohs(tvb, start); |
| 781 | | | hex_fmt = tlv_val_2byte; |
| 782 | | | break; |
| 783 | | | case 3: |
| 784 | | | tlv_value = tvb_get_ntoh24(tvb, start); |
| 785 | | | hex_fmt = tlv_val_3byte; |
| 786 | | | break; |
| 787 | | | case 4: |
| 788 | | | tlv_value = tvb_get_ntohl(tvb, start); |
| 789 | | | hex_fmt = tlv_val_4byte; |
| 790 | | | break; |
| 791 | | | default: |
| 792 | | | tlv_value = tvb_get_ntohl(tvb, start); |
| 793 | | | hex_fmt = tlv_val_5byte; |
| 794 | | | break; |
| 795 | | | } |
| 796 | | | |
| 797 | | | tlv_item = proto_tree_add_text(tlv_tree, tvb, start, length, hex_fmt, message, tlv_value); |
Format String
proto_tree_add_text() is being called with a format string that is not constant. The format string (fifth argument) may not match the other arguments to proto_tree_add_text(); this could lead to security or stability problems. proto_tree_add_text() is usually called with strings that look like format strings in this project. |
|
| 798 | | | tlv_tree = proto_item_add_subtree(tlv_item, idx); |
| 799 | | | |
| 800 | | | |
| 801 | | | return tlv_tree; |
| 802 | | | } |
| |