(/home/sate/Testcases/c/cve/wireshark-1.2.0/gtk/iax2_analysis.c) |
| |
| 1898 | | | static gboolean save_csv_as_ok_cb(GtkWidget *w _U_, gpointer fc ) |
| 1899 | | | { |
| 1900 | | | gchar *g_dest; |
| 1901 | | | GtkWidget *rev, *forw, *both; |
| 1902 | | | user_data_t *user_data; |
| 1903 | | | |
| 1904 | | | GtkListStore *store; |
| 1905 | | | GtkTreeIter iter; |
| 1906 | | | GtkTreeModel *model; |
| 1907 | | | gboolean more_items = TRUE; |
Event 1:
!0 evaluates to true.
hide
|
|
| 1908 | | | |
| 1909 | | | |
| 1910 | | | guint packet; |
| 1911 | | | gfloat delta; |
| 1912 | | | gfloat jitter; |
| 1913 | | | gfloat ipbw; |
| 1914 | | | char *status_str; |
| 1915 | | | char *date_str; |
| 1916 | | | guint length; |
| 1917 | | | |
| 1918 | | | FILE *fp; |
| 1919 | | | int j; |
| 1920 | | | |
| 1921 | | | g_dest = gtk_file_chooser_get_filename(GTK_FILE_CHOOSER(fc));
x /usr/include/gtk-2.0/gtk/gtkfilechooser.h |
| |
34 | #define GTK_FILE_CHOOSER(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GTK_TYPE_FILE_CHOOSER, GtkFileChooser)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/gtk-2.0/gtk/gtkfilechooser.h |
| |
33 | #define GTK_TYPE_FILE_CHOOSER (gtk_file_chooser_get_type ()) |
| |
|
| 1922 | | | |
| 1923 | | | |
| 1924 | | | |
| 1925 | | | |
| 1926 | [+] | | if (test_for_directory(g_dest) == EISDIR) {
x /usr/include/asm-generic/errno-base.h |
| |
24 | #define EISDIR 21 /* Is a directory */ |
| |
|
Event 6:
g_dest, which evaluates to gtk_file_chooser_get_filename(...) from iax2_analysis.c:1921, is passed to test_for_directory(). See related event 5.
hide
|
|
 |
| 1927 | | | |
| 1928 | | | set_last_open_dir(g_dest); |
| 1929 | | | file_selection_set_current_folder(fc, get_last_open_dir()); |
| 1930 | | | gtk_file_chooser_set_current_name(fc, ""); |
| 1931 | | | g_free(g_dest); |
| 1932 | | | return FALSE; |
| 1933 | | | } |
| 1934 | | | rev = (GtkWidget*)g_object_get_data(G_OBJECT(fc), "reversed_rb");
x /usr/include/glib-2.0/gobject/gobject.h |
| |
52 | #define G_OBJECT(object) (G_TYPE_CHECK_INSTANCE_CAST ((object), G_TYPE_OBJECT, GObject)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
181 | #define G_TYPE_OBJECT G_TYPE_MAKE_FUNDAMENTAL (20) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
222 | #define G_TYPE_MAKE_FUNDAMENTAL(x) ((GType) ((x) << G_TYPE_FUNDAMENTAL_SHIFT)) |
| |
|
| 1935 | | | forw = (GtkWidget*)g_object_get_data(G_OBJECT(fc), "forward_rb");
x /usr/include/glib-2.0/gobject/gobject.h |
| |
52 | #define G_OBJECT(object) (G_TYPE_CHECK_INSTANCE_CAST ((object), G_TYPE_OBJECT, GObject)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
181 | #define G_TYPE_OBJECT G_TYPE_MAKE_FUNDAMENTAL (20) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
222 | #define G_TYPE_MAKE_FUNDAMENTAL(x) ((GType) ((x) << G_TYPE_FUNDAMENTAL_SHIFT)) |
| |
|
| 1936 | | | both = (GtkWidget*)g_object_get_data(G_OBJECT(fc), "both_rb");
x /usr/include/glib-2.0/gobject/gobject.h |
| |
52 | #define G_OBJECT(object) (G_TYPE_CHECK_INSTANCE_CAST ((object), G_TYPE_OBJECT, GObject)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
181 | #define G_TYPE_OBJECT G_TYPE_MAKE_FUNDAMENTAL (20) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
222 | #define G_TYPE_MAKE_FUNDAMENTAL(x) ((GType) ((x) << G_TYPE_FUNDAMENTAL_SHIFT)) |
| |
|
| 1937 | | | user_data = (user_data_t*)g_object_get_data(G_OBJECT(fc), "user_data");
x /usr/include/glib-2.0/gobject/gobject.h |
| |
52 | #define G_OBJECT(object) (G_TYPE_CHECK_INSTANCE_CAST ((object), G_TYPE_OBJECT, GObject)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
181 | #define G_TYPE_OBJECT G_TYPE_MAKE_FUNDAMENTAL (20) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
222 | #define G_TYPE_MAKE_FUNDAMENTAL(x) ((GType) ((x) << G_TYPE_FUNDAMENTAL_SHIFT)) |
| |
|
| 1938 | | | |
| 1939 | | | if (GTK_TOGGLE_BUTTON(forw)->active || GTK_TOGGLE_BUTTON(both)->active) {
x /usr/include/gtk-2.0/gtk/gtktogglebutton.h |
| |
41 | #define GTK_TOGGLE_BUTTON(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GTK_TYPE_TOGGLE_BUTTON, GtkToggleButton)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/gtk-2.0/gtk/gtktogglebutton.h |
| |
40 | #define GTK_TYPE_TOGGLE_BUTTON (gtk_toggle_button_get_type ()) |
| |
x /usr/include/gtk-2.0/gtk/gtktogglebutton.h |
| |
41 | #define GTK_TOGGLE_BUTTON(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GTK_TYPE_TOGGLE_BUTTON, GtkToggleButton)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/gtk-2.0/gtk/gtktogglebutton.h |
| |
40 | #define GTK_TYPE_TOGGLE_BUTTON (gtk_toggle_button_get_type ()) |
| |
|
Event 20:
gtk_toggle_button_get_type is an Undefined Function.
hide
Event 21:
g_type_check_instance_cast is an Undefined Function.
hide
Event 22:
Taking true branch. ((GtkToggleButton *)g_type_check_instance_cast(...))->active evaluates to true.
hide
|
|
| 1940 | | | fp = ws_fopen(g_dest, "w"); |
Event 23:
g_dest, which evaluates to gtk_file_chooser_get_filename(...) from iax2_analysis.c:1921, is passed to fopen() as the first argument. See related events 5 and 8.
hide
File System Race Condition
The file named g_dest is accessed again. Another process may have changed the file since the access at filesystem.c:215. For example, an attacker could replace the original file with a link to a file containing important or confidential data. The issue can occur if the highlighted code executes. See related events 9 and 23. Show: All events | Only primary events |
|
| |