https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4992
--- Comment #10 from Flier Lu <flier.lu@xxxxxxxxx> 2010-07-13 08:55:44 PDT ---
Created an attachment (id=4914)
--> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=4914)
use tvb_format_text instead of tvb_get_ptr
I have fixed the tvb_get_ptr issues base on Gerald's suggestion, but there are
an another strange crash when I run the fuzz-test.sh
[flierlu@web wireshark]$ ./tools/fuzz-test.sh plugins/gearman/gearman.pcap
Running ./tshark with args: -nVxr (forever)
Starting pass 1:
plugins/gearman/gearman.pcap: ./tools/fuzz-test.sh: line 138: 26218 Aborted
(core dumped) "$TSHARK" $TSHARK_ARGS $TMP_DIR/$TMP_FILE >
/dev/null 2> $TMP_DIR/$ERR_FILE
ERROR
Processing failed. Capture info follows:
Output file: /tmp/fuzz-2010-07-13-26169.pcap
[flierlu@web wireshark]$ gdb /opt/disk2/home/flierlu/wireshark/.libs/lt-tshark
core.
core.26218 core.9453
[flierlu@web wireshark]$ gdb /opt/disk2/home/flierlu/wireshark/.libs/lt-tshark
core.26218
...
#11 0xb5cda5ae in g_malloc () from /usr/lib/libglib-2.0.so.0
#12 0xb62e921e in tvb_get_string (tvb=0xa051878, offset=1, length=3) at
tvbuff.c:2222
#13 0xb656e5b4 in dissect_binary_packet (tvb=0xa051878, pinfo=0xbf88f134,
gearman_tree=0xa1665a8) at packet-gearman.c:213
The code crash when it call g_malloc
void
dissect_binary_packet(tvbuff_t *tvb, packet_info *pinfo, proto_tree
*gearman_tree)
{
gint offset = 0;
char *magic_code = NULL;
guint32 type, size;
while (tvb_length_remaining(tvb, offset) >= GEARMAN_COMMAND_HEADER_SIZE)
{
magic_code = tvb_get_string(tvb, offset+1, 3); // crash here
but the tvb_get_string only try to allocate 2 bytes buffer
guint8 *
tvb_get_string(tvbuff_t *tvb, const gint offset, const gint length)
{
const guint8 *ptr;
guint8 *strbuf = NULL;
tvb_ensure_bytes_exist(tvb, offset, length);
ptr = ensure_contiguous(tvb, offset, length);
strbuf = g_malloc(length + 1); // crash here
if (length != 0) {
memcpy(strbuf, ptr, length);
}
strbuf[length] = '\0';
return strbuf;
}
I have no idea why and how to fix it, could you give me some advices?
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
