https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6139
Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
CC| |jeff.morriss.ws@xxxxxxxxx
Resolution| |FIXED
--- Comment #4 from Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> 2011-08-09 08:44:27 PDT ---
Still crashes for me on Linux. Backtrace is:
#0 0x00000031a0a80e50 in strlen () from /lib64/libc.so.6
#1 0x00000031a0a4961e in vfprintf () from /lib64/libc.so.6
#2 0x00000031a0afc928 in __vsnprintf_chk () from /lib64/libc.so.6
#3 0x00007ff1d23b54bf in proto_tree_set_representation (pi=<value optimized
out>,
format=0x7ff1d2e33fa0 "ERROR %s %s (%s)", ap=0x7fff72c886d0) at
../../epan/proto.c:3668
#4 0x00007ff1d23b6be8 in proto_tree_add_text (tree=0x7ff1d11b20e0, tvb=<value
optimized out>,
start=<value optimized out>, length=<value optimized out>,
format=0x7ff1d2e33fa0 "ERROR %s %s (%s)")
at ../../epan/proto.c:1051
#5 0x00007ff1d25098a6 in ProcessError (tree=0x5, tvb=0x7ff1d2e33fab,
bit_offset=16843008,
sz=<value optimized out>, err=-5, pDescr=<value optimized out>)
at ../../../epan/dissectors/packet-csn1.c:105
#6 0x00007ff1d2509b1a in csnStreamDissector (tree=0x7ff1d11b2020,
ar=0x7fff72c88a90,
pDescr=0x7fff72c88a68, tvb=0x2f2c5e0, data=0x7ff1d0494660, ett_csn1=7852)
at ../../../epan/dissectors/packet-csn1.c:1476
#7 0x00007ff1d250a437 in csnStreamDissector (tree=0x7ff1d11b1fc0,
ar=0x7fff72c88c10,
pDescr=0x7ff1d38d2720, tvb=0x2f2c5e0, data=0x7ff1d0494660, ett_csn1=7852)
at ../../../epan/dissectors/packet-csn1.c:548
#8 0x00007ff1d250ab9e in csnStreamDissector (tree=0x7ff1d11b1ba0,
ar=0x7fff72c88d90,
pDescr=0x7ff1d38ce300, tvb=0x2f2c5e0, data=0x7ff1d049465c, ett_csn1=7852)
at ../../../epan/dissectors/packet-csn1.c:1376
#9 0x00007ff1d250a27e in csnStreamDissector (tree=0x7ff1d11b1210,
ar=0x7fff72c88de0,
pDescr=0x7ff1d38c8d00, tvb=0x2f2c5e0, data=0x7ff1d0494648, ett_csn1=7852)
at ../../../epan/dissectors/packet-csn1.c:496
#10 0x00007ff1d2648def in dissect_gsm_rlcmac_uplink (tvb=0x2f2c5e0,
pinfo=0x7fff72c89a80,
tree=0x7ff1d11b1000) at ../../../epan/dissectors/packet-gsm_rlcmac.c:5475
#11 0x00007ff1d23a6cd1 in call_dissector_through_handle (handle=0x1ed6cf0,
tvb=0x2f2c5e0,
pinfo=0x7fff72c89a80, tree=0x7ff1d11b1000) at ../../epan/packet.c:384
Unfortunately all the variables in frame 5 are optimized out and weirdly if I
turn off optimization the crash doesn't happen.
But, digging further, I think the problem is in frame 7 with this code:
~~~
525 if (value == pChoice->value)
526 {
527 CSN_DESCR descr[2];
528 gint16 Status;
529 csnStream_t arT = *ar;
530 proto_item *ti;
531 proto_tree *test_tree;
532
533 descr[0] = pChoice->descr;
534 descr[1].type = CSN_END; <<< why are we initializing the
2nd entry in the array?
[...]
548 Status = csnStreamDissector(test_tree, &arT, descr, tvb,
data, ett_csn1);
~~~
The (recursive) csnStreamDissector() call immediately does a switch on the
pDescr->type, so I'm pretty sure the initialization of 'type' is supposed to be
done on entry 0 instead of 1. Changing it eliminates the uninitialized
variable read and fixes the crash.
(BTW, CSN_END is 0; this may explain why turning optimization off prevented the
crash: uninitialized memory is frequently--but certainly not always--0.)
Fixed in rev 38430.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
