Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 7287] Buildbot crash output: fuzz-2012-05-25-11175.pcap

Date: Sun, 27 May 2012 17:50:45 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7287

Guy Harris <guy@xxxxxxxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
          Component|Extras                      |TShark
            Version|unspecified                 |SVN
         Resolution|                            |FIXED

--- Comment #10 from Guy Harris <guy@xxxxxxxxxxxx> 2012-05-27 17:50:44 PDT ---
Currently, the way Wiretap works, the interface list for a capture file has to
be constructed in the open routine; otherwise, programs such as editcap don't
see them, and thus can't pass them to the dump routines, so, when writing a
pcap-ng file, the interface list will have to be synthesized by Wiretap, and
will have oly one entry.

For LINKTYPE_ERF pcap files, an interface list with 4 entries is synthesized,
and packets are supplied with an interface ID value from 0 to 3.

This means that, if the interface list isn't constructed in the open routine,
when reading a pcap file and writing a pcap-ng file in a single-pass program -
such as editcap, which is what's used to fuzz captures - any packets with an
interface ID value that's not zero will not have a corresponding IDB, so any
such packets will render the pcap-ng file invalid.

Fixed in rev 42872.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.