func: static tvbuff_t *CVE_2015_3811_VULN_wcp_uncompress( tvbuff_t *src_tvb, int offset, packet_info *pinfo, proto_tree *tree) int len , i ; int cnt = tvb_reported_length ( src_tvb ) - 1 ; guint8 * dst , * src , * buf_start , * buf_end , comp_flag_bits = 0 ; guint16 data_offset , data_cnt ; guint8 src_buf [ MAX_WCP_BUF_LEN ] ; wcp_pdata_t * pdata_ptr ; buf_ptr = get_wcp_window_ptr ( pinfo ); buf_start = buf_ptr -> buffer; buf_end = buf_start + MAX_WIN_BUF_LEN; if ( cnt - offset > MAX_WCP_BUF_LEN )  src = ( guint8 * ) tvb_memcpy ( src_tvb , src_buf , offset , cnt - offset ); dst = buf_ptr -> buf_cur; len = 0; i = - 1; while ( offset < cnt )  if ( -- i >= 0 )  if ( comp_flag_bits & 0x80 )  data_offset = pntoh16 ( src ) & WCP_OFFSET_MASK; if ( ( * src & 0xf0 ) == 0x10 )  data_cnt = * ( src + 2 ) + 1; src += 3; offset += 3; data_cnt = ( * src >> 4 ) + 1; src += 2; offset += 2; if ( ! pinfo -> fd -> flags . visited )  dst = decompressed_entry ( dst , data_offset , data_cnt , & len , buf_start , buf_end ); if ( dst == NULL )  if ( ++ len > MAX_WCP_BUF_LEN )  if ( ! pinfo -> fd -> flags . visited )  * dst = * src; if ( dst ++ == buf_end )  dst = buf_start; comp_flag_bits <<= 1; comp_flag_bits = * src ++; offset ++; i = 8; if ( pinfo -> fd -> flags . visited )  pdata_ptr = wmem_new ( wmem_file_scope ( ) , wcp_pdata_t ); memcpy ( & pdata_ptr -> buffer , buf_ptr -> buf_cur , len ); pdata_ptr -> len = len; p_add_proto_data ( wmem_file_scope ( ) , pinfo , proto_wcp , 0 , ( void * ) pdata_ptr ); tvb = tvb_new_child_real_data ( src_tvb , pdata_ptr -> buffer , pdata_ptr -> len , pdata_ptr -> len ); add_new_data_source ( pinfo , tvb , "Uncompressed WCP" ); return tvb ; 