(/home/sate/Testcases/c/cve/wireshark-1.2.0/gtk/iax2_analysis.c) |
| |
| 1898 | | | static gboolean save_csv_as_ok_cb(GtkWidget *w _U_, gpointer fc ) |
| 1899 | | | { |
| 1900 | | | gchar *g_dest; |
| 1901 | | | GtkWidget *rev, *forw, *both; |
| 1902 | | | user_data_t *user_data; |
| 1903 | | | |
| 1904 | | | GtkListStore *store; |
| 1905 | | | GtkTreeIter iter; |
| 1906 | | | GtkTreeModel *model; |
| 1907 | | | gboolean more_items = TRUE; |
Event 1:
!0 evaluates to true.
hide
|
|
| 1908 | | | |
| 1909 | | | |
| 1910 | | | guint packet; |
| 1911 | | | gfloat delta; |
| 1912 | | | gfloat jitter; |
| 1913 | | | gfloat ipbw; |
| 1914 | | | char *status_str; |
| 1915 | | | char *date_str; |
| 1916 | | | guint length; |
| 1917 | | | |
| 1918 | | | FILE *fp; |
| 1919 | | | int j; |
| 1920 | | | |
| 1921 | | | g_dest = gtk_file_chooser_get_filename(GTK_FILE_CHOOSER(fc));
x /usr/include/gtk-2.0/gtk/gtkfilechooser.h |
| |
34 | #define GTK_FILE_CHOOSER(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GTK_TYPE_FILE_CHOOSER, GtkFileChooser)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/gtk-2.0/gtk/gtkfilechooser.h |
| |
33 | #define GTK_TYPE_FILE_CHOOSER (gtk_file_chooser_get_type ()) |
| |
|
| 1922 | | | |
| 1923 | | | |
| 1924 | | | |
| 1925 | | | |
| 1926 | [+] | | if (test_for_directory(g_dest) == EISDIR) {
x /usr/include/asm-generic/errno-base.h |
| |
24 | #define EISDIR 21 /* Is a directory */ |
| |
|
Event 6:
g_dest, which evaluates to gtk_file_chooser_get_filename(...) from iax2_analysis.c:1921, is passed to test_for_directory(). See related event 5.
hide
|
|
 |
| 1927 | | | |
| 1928 | | | set_last_open_dir(g_dest); |
| 1929 | | | file_selection_set_current_folder(fc, get_last_open_dir()); |
| 1930 | | | gtk_file_chooser_set_current_name(fc, ""); |
| 1931 | | | g_free(g_dest); |
| 1932 | | | return FALSE; |
| 1933 | | | } |
| 1934 | | | rev = (GtkWidget*)g_object_get_data(G_OBJECT(fc), "reversed_rb");
x /usr/include/glib-2.0/gobject/gobject.h |
| |
52 | #define G_OBJECT(object) (G_TYPE_CHECK_INSTANCE_CAST ((object), G_TYPE_OBJECT, GObject)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
181 | #define G_TYPE_OBJECT G_TYPE_MAKE_FUNDAMENTAL (20) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
222 | #define G_TYPE_MAKE_FUNDAMENTAL(x) ((GType) ((x) << G_TYPE_FUNDAMENTAL_SHIFT)) |
| |
|
| 1935 | | | forw = (GtkWidget*)g_object_get_data(G_OBJECT(fc), "forward_rb");
x /usr/include/glib-2.0/gobject/gobject.h |
| |
52 | #define G_OBJECT(object) (G_TYPE_CHECK_INSTANCE_CAST ((object), G_TYPE_OBJECT, GObject)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
181 | #define G_TYPE_OBJECT G_TYPE_MAKE_FUNDAMENTAL (20) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
222 | #define G_TYPE_MAKE_FUNDAMENTAL(x) ((GType) ((x) << G_TYPE_FUNDAMENTAL_SHIFT)) |
| |
|
| 1936 | | | both = (GtkWidget*)g_object_get_data(G_OBJECT(fc), "both_rb");
x /usr/include/glib-2.0/gobject/gobject.h |
| |
52 | #define G_OBJECT(object) (G_TYPE_CHECK_INSTANCE_CAST ((object), G_TYPE_OBJECT, GObject)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
181 | #define G_TYPE_OBJECT G_TYPE_MAKE_FUNDAMENTAL (20) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
222 | #define G_TYPE_MAKE_FUNDAMENTAL(x) ((GType) ((x) << G_TYPE_FUNDAMENTAL_SHIFT)) |
| |
|
| 1937 | | | user_data = (user_data_t*)g_object_get_data(G_OBJECT(fc), "user_data");
x /usr/include/glib-2.0/gobject/gobject.h |
| |
52 | #define G_OBJECT(object) (G_TYPE_CHECK_INSTANCE_CAST ((object), G_TYPE_OBJECT, GObject)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
181 | #define G_TYPE_OBJECT G_TYPE_MAKE_FUNDAMENTAL (20) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
222 | #define G_TYPE_MAKE_FUNDAMENTAL(x) ((GType) ((x) << G_TYPE_FUNDAMENTAL_SHIFT)) |
| |
|
| 1938 | | | |
| 1939 | | | if (GTK_TOGGLE_BUTTON(forw)->active || GTK_TOGGLE_BUTTON(both)->active) {
x /usr/include/gtk-2.0/gtk/gtktogglebutton.h |
| |
41 | #define GTK_TOGGLE_BUTTON(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GTK_TYPE_TOGGLE_BUTTON, GtkToggleButton)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/gtk-2.0/gtk/gtktogglebutton.h |
| |
40 | #define GTK_TYPE_TOGGLE_BUTTON (gtk_toggle_button_get_type ()) |
| |
x /usr/include/gtk-2.0/gtk/gtktogglebutton.h |
| |
41 | #define GTK_TOGGLE_BUTTON(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GTK_TYPE_TOGGLE_BUTTON, GtkToggleButton)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/gtk-2.0/gtk/gtktogglebutton.h |
| |
40 | #define GTK_TYPE_TOGGLE_BUTTON (gtk_toggle_button_get_type ()) |
| |
|
Event 19:
gtk_toggle_button_get_type is an Undefined Function.
hide
Event 20:
g_type_check_instance_cast is an Undefined Function.
hide
Event 21:
Taking true branch. ((GtkToggleButton *)g_type_check_instance_cast(...))->active evaluates to true.
hide
|
|
| 1940 | | | fp = ws_fopen(g_dest, "w"); |
Event 22:
g_dest, which evaluates to gtk_file_chooser_get_filename(...) from iax2_analysis.c:1921, is passed to fopen() as the first argument. See related events 5 and 8.
hide
Event 23:
fopen() accesses the file named g_dest, where g_dest is gtk_file_chooser_get_filename(...) from iax2_analysis.c:1921. - The same name is used to access a file later, but it is not safe to assume that it will be the same underlying file.
See related event 22.
hide
|
|
| 1941 | | | if (fp == NULL) { |
Event 24:
Skipping " if". fp == (void *)0 evaluates to false.
hide
|
|
| 1942 | | | open_failure_alert_box(g_dest, errno, TRUE); |
| 1943 | | | g_free(g_dest); |
| 1944 | | | return TRUE; |
| 1945 | | | } |
| 1946 | | | |
| 1947 | | | if (GTK_TOGGLE_BUTTON(both)->active) {
x /usr/include/gtk-2.0/gtk/gtktogglebutton.h |
| |
41 | #define GTK_TOGGLE_BUTTON(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GTK_TYPE_TOGGLE_BUTTON, GtkToggleButton)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/gtk-2.0/gtk/gtktogglebutton.h |
| |
40 | #define GTK_TYPE_TOGGLE_BUTTON (gtk_toggle_button_get_type ()) |
| |
|
Event 25:
gtk_toggle_button_get_type is an Undefined Function.
hide
Event 26:
g_type_check_instance_cast is an Undefined Function.
hide
Event 27:
Skipping " if". ((GtkToggleButton *)g_type_check_instance_cast(...))->active evaluates to false.
hide
|
|
| 1948 | | | fprintf(fp, "Forward\n"); |
| 1949 | | | if (ferror(fp)) { |
| 1950 | | | write_failure_alert_box(g_dest, errno); |
| 1951 | | | fclose(fp); |
| 1952 | | | g_free(g_dest); |
| 1953 | | | return TRUE; |
| 1954 | | | } |
| 1955 | | | } |
| 1956 | | | |
| 1957 | | | for(j = 0; j < NUM_COLS; j++) { |
| 1958 | | | if (j == 0) { |
| 1959 | | | fprintf(fp,"%s",titles[j]); |
| 1960 | | | } else { |
| 1961 | | | fprintf(fp,",%s",titles[j]); |
| 1962 | | | } |
| 1963 | | | } |
| 1964 | | | fprintf(fp,"\n"); |
| 1965 | | | if (ferror(fp)) { |
Event 29:
Skipping " if". ferror(fp) evaluates to false.
hide
|
|
| 1966 | | | write_failure_alert_box(g_dest, errno); |
| 1967 | | | fclose(fp); |
| 1968 | | | g_free(g_dest); |
| 1969 | | | return TRUE; |
| 1970 | | | } |
| 1971 | | | model = gtk_tree_view_get_model(GTK_TREE_VIEW(user_data->dlg.list_fwd));
x /usr/include/gtk-2.0/gtk/gtktreeview.h |
| |
49 | #define GTK_TREE_VIEW(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GTK_TYPE_TREE_VIEW, GtkTreeView)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/gtk-2.0/gtk/gtktreeview.h |
| |
48 | #define GTK_TYPE_TREE_VIEW (gtk_tree_view_get_type ()) |
| |
|
| 1972 | | | store = GTK_LIST_STORE(model);
x /usr/include/gtk-2.0/gtk/gtkliststore.h |
| |
36 | #define GTK_LIST_STORE(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GTK_TYPE_LIST_STORE, GtkListStore)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/gtk-2.0/gtk/gtkliststore.h |
| |
35 | #define GTK_TYPE_LIST_STORE (gtk_list_store_get_type ()) |
| |
|
| 1973 | | | if( gtk_tree_model_get_iter_first(GTK_TREE_MODEL(store), &iter) ) {
x /usr/include/gtk-2.0/gtk/gtktreemodel.h |
| |
35 | #define GTK_TREE_MODEL(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GTK_TYPE_TREE_MODEL, GtkTreeModel)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/gtk-2.0/gtk/gtktreemodel.h |
| |
34 | #define GTK_TYPE_TREE_MODEL (gtk_tree_model_get_type ()) |
| |
|
| 1974 | | | |
| 1975 | | | while (more_items) { |
| 1976 | | | gtk_tree_model_get(GTK_TREE_MODEL(store), &iter,
x /usr/include/gtk-2.0/gtk/gtktreemodel.h |
| |
35 | #define GTK_TREE_MODEL(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GTK_TYPE_TREE_MODEL, GtkTreeModel)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/gtk-2.0/gtk/gtktreemodel.h |
| |
34 | #define GTK_TYPE_TREE_MODEL (gtk_tree_model_get_type ()) |
| |
|
| 1977 | | | 0, &packet, |
| 1978 | | | 1, &delta, |
| 1979 | | | 2, &jitter, |
| 1980 | | | 3, &ipbw, |
| 1981 | | | 4, &status_str, |
| 1982 | | | 5, &date_str, |
| 1983 | | | 6, &length, |
| 1984 1995 |  | | [ Lines 1984 to 1995 omitted. ] |
| 1996 | | | write_failure_alert_box(g_dest, errno); |
| 1997 | | | fclose(fp); |
| 1998 | | | g_free(g_dest); |
| 1999 | | | return TRUE; |
| 2000 | | | } |
| 2001 | | | |
| 2002 | | | more_items = gtk_tree_model_iter_next (model,&iter); |
| 2003 | | | } |
| 2004 | | | } |
| 2005 | | | |
| 2006 | | | if (fclose(fp) == EOF) { |
Event 39:
Skipping " if". fclose(fp) == -1 evaluates to false.
hide
|
|
| 2007 | | | write_failure_alert_box(g_dest, errno); |
| 2008 | | | g_free(g_dest); |
| 2009 | | | return TRUE; |
| 2010 | | | } |
| 2011 | | | } |
| 2012 | | | |
| 2013 | | | if (GTK_TOGGLE_BUTTON(rev)->active || GTK_TOGGLE_BUTTON(both)->active) {
x /usr/include/gtk-2.0/gtk/gtktogglebutton.h |
| |
41 | #define GTK_TOGGLE_BUTTON(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GTK_TYPE_TOGGLE_BUTTON, GtkToggleButton)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/gtk-2.0/gtk/gtktogglebutton.h |
| |
40 | #define GTK_TYPE_TOGGLE_BUTTON (gtk_toggle_button_get_type ()) |
| |
x /usr/include/gtk-2.0/gtk/gtktogglebutton.h |
| |
41 | #define GTK_TOGGLE_BUTTON(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GTK_TYPE_TOGGLE_BUTTON, GtkToggleButton)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/gtk-2.0/gtk/gtktogglebutton.h |
| |
40 | #define GTK_TYPE_TOGGLE_BUTTON (gtk_toggle_button_get_type ()) |
| |
|
Event 40:
gtk_toggle_button_get_type is an Undefined Function.
hide
Event 41:
g_type_check_instance_cast is an Undefined Function.
hide
Event 42:
Taking true branch. ((GtkToggleButton *)g_type_check_instance_cast(...))->active evaluates to true.
hide
|
|
| 2014 | | | |
| 2015 | | | if (GTK_TOGGLE_BUTTON(both)->active) {
x /usr/include/gtk-2.0/gtk/gtktogglebutton.h |
| |
41 | #define GTK_TOGGLE_BUTTON(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GTK_TYPE_TOGGLE_BUTTON, GtkToggleButton)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/gtk-2.0/gtk/gtktogglebutton.h |
| |
40 | #define GTK_TYPE_TOGGLE_BUTTON (gtk_toggle_button_get_type ()) |
| |
|
Event 43:
gtk_toggle_button_get_type is an Undefined Function.
hide
Event 44:
g_type_check_instance_cast is an Undefined Function.
hide
Event 45:
Taking true branch. ((GtkToggleButton *)g_type_check_instance_cast(...))->active evaluates to true.
hide
|
|
| 2016 | | | fp = ws_fopen(g_dest, "a"); |
Event 46:
g_dest, which evaluates to gtk_file_chooser_get_filename(...) from iax2_analysis.c:1921, is passed to fopen() as the first argument. See related events 5 and 8.
hide
File System Race Condition
The file named g_dest is accessed again. Another process may have changed the file since the access at iax2_analysis.c:1940. For example, an attacker could replace the original file with a link to a file containing important or confidential data. The issue can occur if the highlighted code executes. See related events 23 and 46. Show: All events | Only primary events |
|
| |