(/home/sate/Testcases/c/cve/wireshark-1.2.0/epan/dissectors/packet-mgcp.c) |
| |
| 1868 | | | dissect_mgcp_connectionparams(proto_tree *parent_tree, tvbuff_t *tvb, gint offset, gint param_type_len, gint param_val_len) |
| 1869 | | | { |
| 1870 | | | proto_tree *tree = parent_tree; |
| 1871 | | | proto_item *item = NULL; |
| 1872 | | | |
| 1873 | | | gchar *tokenline = NULL; |
| 1874 | | | gchar **tokens = NULL; |
| 1875 | | | gchar **typval = NULL; |
| 1876 | | | guint i = 0; |
| 1877 | | | guint tokenlen = 0; |
| 1878 | | | int hf_uint = -1; |
| 1879 | | | int hf_string = -1; |
| 1880 | | | |
| 1881 | | | if (parent_tree) |
Event 1:
Skipping " if". parent_tree evaluates to false.
hide
|
|
| 1882 | | | { |
| 1883 | | | item = proto_tree_add_item(parent_tree, hf_mgcp_param_connectionparam, tvb, offset, param_type_len+param_val_len, FALSE); |
| 1884 | | | tree = proto_item_add_subtree(item, ett_mgcp_param_connectionparam); |
| 1885 | | | } |
| 1886 | | | |
| 1887 | | | |
| 1888 | | | offset += param_type_len; |
| 1889 | | | tokenline = tvb_get_ephemeral_string(tvb, offset, param_val_len); |
| 1890 | | | |
| 1891 | | | |
| 1892 | | | tokens = ep_strsplit(tokenline, ",", -1); |
| 1893 | | | |
| 1894 | | | for (i = 0; tokens[i] != NULL; i++) |
Event 3:
Continuing from loop body. Entering loop body. tokens[i] != (void *)0 evaluates to true.
hide
|
|
| 1895 | | | { |
| 1896 | | | tokenlen = (int)strlen(tokens[i]); |
| 1897 | [+] | | typval = ep_strsplit(tokens[i], "=", 2); |
 |
| 1898 | | | if ((typval[0] != NULL) && (typval[1] != NULL)) |
Null Pointer Dereference
typval is dereferenced here, but it is NULL. The issue can occur if the highlighted code executes. See related event 6. Show: All events | Only primary events |
|
| 1899 | | | { |
| 1900 | | | if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "PS"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 1901 | | | { |
| 1902 | | | hf_uint = hf_mgcp_param_connectionparam_ps; |
| 1903 | | | } |
| 1904 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "OS"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 1905 | | | { |
| 1906 | | | hf_uint = hf_mgcp_param_connectionparam_os; |
| 1907 | | | } |
| 1908 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "PR"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 1909 | | | { |
| 1910 | | | hf_uint = hf_mgcp_param_connectionparam_pr; |
| 1911 | | | } |
| 1912 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "OR"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 1913 | | | { |
| 1914 | | | hf_uint = hf_mgcp_param_connectionparam_or; |
| 1915 | | | } |
| 1916 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "PL"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 1917 | | | { |
| 1918 | | | hf_uint = hf_mgcp_param_connectionparam_pl; |
| 1919 | | | } |
| 1920 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "JI"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 1921 | | | { |
| 1922 | | | hf_uint = hf_mgcp_param_connectionparam_ji; |
| 1923 | | | } |
| 1924 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "LA"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 1925 | | | { |
| 1926 | | | hf_uint = hf_mgcp_param_connectionparam_la; |
| 1927 | | | } |
| 1928 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "PC/RPS"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 1929 | | | { |
| 1930 | | | hf_uint = hf_mgcp_param_connectionparam_pcrps; |
| 1931 | | | } else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "PC/ROS"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 1932 | | | { |
| 1933 | | | hf_uint = hf_mgcp_param_connectionparam_pcros; |
| 1934 | | | } |
| 1935 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "PC/RPL"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 1936 | | | { |
| 1937 | | | hf_uint = hf_mgcp_param_connectionparam_pcrpl; |
| 1938 | | | } |
| 1939 | | | else if (!g_ascii_strcasecmp(g_strstrip(typval[0]), "PC/RJI"))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 1940 | | | { |
| 1941 | | | hf_uint = hf_mgcp_param_connectionparam_pcrji; |
| 1942 | | | } |
| 1943 | | | else if (!g_ascii_strncasecmp(g_strstrip(typval[0]), "X-", 2))
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 1944 | | | { |
| 1945 | | | hf_string = hf_mgcp_param_connectionparam_x; |
| 1946 | | | } |
| 1947 | | | else |
| 1948 | | | { |
| 1949 | | | hf_uint = -1; |
| 1950 | | | hf_string = -1; |
| 1951 | | | } |
| 1952 | | | |
| 1953 | | | if (tree) |
| 1954 | | | { |
| 1955 | | | if (hf_uint != -1) |
| 1956 | | | { |
| 1957 | | | proto_tree_add_uint(tree, hf_uint, tvb, offset, tokenlen, atol(typval[1])); |
| 1958 | | | } |
| 1959 | | | else if (hf_string != -1) |
| 1960 | | | { |
| 1961 | | | proto_tree_add_string(tree, hf_string, tvb, offset, tokenlen, g_strstrip(typval[1]));
x /usr/include/glib-2.0/glib/gstrfuncs.h |
| |
158 | #define g_strstrip( string ) g_strchomp (g_strchug (string)) |
| |
|
| 1962 | | | } |
| 1963 | | | else |
| 1964 | | | { |
| 1965 | | | proto_tree_add_text(tree, tvb, offset, tokenlen, "Unknown parameter: %s", tokens[i]); |
| 1966 | | | } |
| 1967 | | | } |
| 1968 | | | } |
| 1969 | | | else if (tree) |
| 1970 | | | { |
| 1971 | | | proto_tree_add_text(tree, tvb, offset, tokenlen, "Malformed parameter: %s", tokens[i]); |
| 1972 | | | } |
| 1973 | | | offset += tokenlen + 1; |
| |