(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-mip6.c) |
| |
| 719 | | | dissect_mipv6_options(tvbuff_t *tvb, int offset, guint length, |
| 720 | | | const ip_tcp_opt *opttab, int nopts, int eol, |
| 721 | | | packet_info *pinfo, proto_tree *opt_tree) |
| 722 | | | { |
| 723 | | | guchar opt; |
| 724 | | | const ip_tcp_opt *optp; |
| 725 | | | opt_len_type len_type; |
| 726 | | | unsigned int optlen; |
| 727 | | | const char *name; |
| 728 | | | char name_str[7+1+1+2+2+1+1]; |
| 729 | | | void (*dissect)(const struct ip_tcp_opt *, tvbuff_t *, |
| 730 | | | int, guint, packet_info *, proto_tree *); |
| 731 | | | guint len; |
| 732 | | | |
| 733 | | | while (length > 0) { |
Event 1:
Performing all but the last loop iteration.
hide
Event 2:
Continuing from loop body. Entering loop body. length > 0 evaluates to true.
hide
|
|
| 734 | | | opt = tvb_get_guint8(tvb, offset); |
| 735 | | | for (optp = &opttab[0]; optp < &opttab[nopts]; optp++) { |
Event 3:
Leaving loop. optp < &opttab[nopts] evaluates to false.
hide
|
|
| 736 | | | if (optp->optcode == opt) |
| 737 | | | break; |
| 738 | | | } |
| 739 | | | if (optp == &opttab[nopts]) { |
Event 4:
Taking false branch. optp == &opttab[nopts] evaluates to false.
hide
|
|
| 740 | | | |
| 741 | | | |
| 742 | | | |
| 743 | | | |
| 744 | | | |
| 745 | | | optp = NULL; |
| 746 | | | len_type = VARIABLE_LENGTH; |
| 747 | | | optlen = 0; |
| 748 | | | g_snprintf(name_str, sizeof name_str, "Unknown (0x%02x)", opt); |
| 749 | | | name = name_str; |
| 750 | | | dissect = NULL; |
| 751 | | | } else { |
| 752 | | | len_type = optp->len_type; |
| 753 | | | optlen = optp->optlen; |
| 754 | | | name = optp->name; |
| 755 | | | dissect = optp->dissect; |
| 756 | | | } |
| 757 | | | --length; |
| 758 | | | if (len_type != NO_LENGTH) { |
Event 6:
Taking true branch. len_type != NO_LENGTH evaluates to true.
hide
|
|
| 759 | | | |
| 760 | | | if (length == 0) { |
Event 7:
Skipping " if". length == 0 evaluates to false.
hide
|
|
| 761 | | | |
| 762 | | | |
| 763 | | | |
| 764 | | | proto_tree_add_text(opt_tree, tvb, offset, 1, |
| 765 | | | "%s (length byte past end of options)", name); |
| 766 | | | return; |
| 767 | | | } |
| 768 | | | len = tvb_get_guint8(tvb, offset + 1); |
| 769 | | | --length; |
| 770 | | | if (len > length) { |
Event 8:
Taking false branch. len > length evaluates to false.
hide
|
|
| 771 | | | |
| 772 | | | proto_tree_add_text(opt_tree, tvb, offset, length, |
| 773 | | | "%s (option length = %u byte%s says option goes past end of options)", |
| 774 | | | name, len, plurality(len, "", "s")); |
| 775 | | | return; |
| 776 | | | } else if (len_type == FIXED_LENGTH && len != optlen) { |
Event 9:
Taking false branch. len_type == FIXED_LENGTH evaluates to false.
hide
|
|
| 777 | | | |
| 778 | | | |
| 779 | | | proto_tree_add_text(opt_tree, tvb, offset, len + 2, |
| 780 | | | "%s (with option length = %u byte%s; should be %u)", name, |
| 781 | | | len, plurality(len, "", "s"), optlen); |
| 782 | | | return; |
| 783 | | | } else if (len_type == VARIABLE_LENGTH && len < optlen) { |
Event 10:
Taking false branch. len_type == VARIABLE_LENGTH evaluates to false.
hide
|
|
| 784 | | | |
| 785 | | | |
| 786 | | | proto_tree_add_text(opt_tree, tvb, offset, len + 2, |
| 787 | | | "%s (with option length = %u byte%s; should be >= %u)", name, |
| 788 | | | len, plurality(len, "", "s"), optlen); |
| 789 | | | return; |
| 790 | | | } else { |
| 791 | | | if (optp == NULL) { |
Null Test After Dereference
This code tests the nullness of optp, which has already been dereferenced. - If optp were null, there would have been a prior null pointer dereference at packet-mip6.c:755, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 5. Show: All events | Only primary events |
|
| 792 | | | proto_tree_add_text(opt_tree, tvb, offset, len + 2, "%s (%u byte%s)", |
| 793 | | | name, len, plurality(len, "", "s")); |
| 794 | | | } else { |
| 795 | | | if (dissect != NULL) { |
| 796 | | | |
| 797 | | | if (opt == LLA) |
| 798 | | | (*dissect)(optp, tvb, offset, |
| 799 | | | len + 2 + FMIP6_LLA_OPTCODE_LEN, pinfo, opt_tree); |
| 800 | | | else |
| 801 | | | (*dissect)(optp, tvb, offset, len + 2, pinfo, opt_tree); |
| 802 | | | } else { |
| 803 | | | |
| 804 | | | proto_tree_add_text(opt_tree, tvb, offset, len + 2, "%s", name); |
| 805 | | | } |
| 806 | | | } |
| 807 | | | |
| 808 | | | |
| 809 | | | |
| 810 | | | |
| 811 | | | if (opt == LLA) |
| 812 | | | offset += len + 2 + FMIP6_LLA_OPTCODE_LEN; |
| 813 | | | else |
| 814 | | | offset += len + 2; |
| 815 | | | } |
| 816 | | | if (opt == LLA) |
| 817 | | | length -= (len + FMIP6_LLA_OPTCODE_LEN); |
| 818 | | | else |
| 819 | | | length -= len; |
| 820 | | | } else { |
| 821 | | | proto_tree_add_text(opt_tree, tvb, offset, 1, "%s", name); |
| 822 | | | offset += 1; |
| 823 | | | } |
| 824 | | | if (opt == eol) |
| 825 | | | break; |
| 826 | | | } |
| 827 | | | } |
| |