Wireshark-bugs: [Wireshark-bugs] [Bug 1151] Tshark segfaults with lots of IP addresses on eth device

From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Tue, 10 Oct 2006 02:57:43 +0000 (GMT)

http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1151





------- Comment #4 from jeff.morriss@xxxxxxxxxxx  2006-10-10 02:57 GMT -------
(In reply to comment #3)
> Am I assuming correctly that tshark tries to open/bind to eth0 for every ip
> address it finds on it? (I'm not familiar with pcap programming.)

Well, at least it gets the list of IP addresses.

> Thread 1 (process 13869):
> #0  0xb6b48b97 in add_addr_to_iflist () from /usr/lib/libpcap.so.0
> No symbol table info available.
> #1  0xb6b3e81e in pcap_findalldevs () from /usr/lib/libpcap.so.0
> No symbol table info available.
> #2  0x0804ed9c in get_interface_list_findalldevs (err=0xbfcd1a38,
> err_str=0xbfcd1938 " \030Íż´\030ÍżÇ5ôˇ \030Íż Xőˇ\b") at
> capture-pcap-util.c:258

It seems to be a problem down in libpcap at this point.  libpcap 0.9.5 has some
updates in this area so it won't segfault if 'malloc()' fails:

http://cvs.tcpdump.org/cgi-bin/cvsweb/libpcap/inet.c?r1=1.66.2.1&r2=1.66.2.2

so that could be the cause of your problem, though that would imply that your
real problem is that you've got too many IP addresses and not enough memory. 
You might want to try libpcap 0.9.5 to see if that's the case or not.  (Even
better would be to compile your own so you can get debug symbols in libpcap.)


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.