Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 4105] Empty custom column field name value causes runtime

Date: Thu, 8 Oct 2009 07:30:41 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4105


Jim Young <jyoung@xxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         OS/Version|Windows XP                  |All




--- Comment #1 from Jim Young <jyoung@xxxxxxx>  2009-10-08 07:30:39 PDT ---
Expanding the affected OSes to "All" from Windows since this bug also can cause
Wireshark to abort on Linux:

> [jyoung@localhost wireshark]$ ./wireshark 
> dumpcap: There are no interfaces on which a capture can be done
> 10:18:33          Err  file proto.c: line 3290 (proto_custom_set): assertion failed: (field_id>=0)
> Aborted
> [jyoung@localhost wireshark]$ 

The abort above occured when Wiresharks was directed to open a small (10
packet) trace file after it had been configured with one empty custom column
field name entry.

Here's the Wireshark particulars:

> [jyoung@localhost wireshark]$ ./tshark -v
> TShark 1.3.1 (SVN Rev 30392 from /trunk)
> 
> Copyright 1998-2009 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
> This is free software; see the source for copying conditions. There is NO
> warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
> 
> Compiled with GLib 2.12.3, with libpcap 0.9.4, with libz 1.2.3, without POSIX
> capabilities, without libpcre, without SMI, without c-ares, without ADNS,
> without Lua, without Python, without GnuTLS, without Gcrypt, without Kerberos,
> without GeoIP.
> NOTE: this build doesn't support the "matches" operator for Wireshark filter
> syntax.
> 
> Running on Linux 2.6.18-92.1.22.el5, with libpcap version 0.9.4.
> 
> Built using gcc 4.1.2 20071124 (Red Hat 4.1.2-42).
> [jyoung@localhost wireshark]$ 


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.