Wireshark

  • Riverbed Technology
  • WinPcap
the world's foremost network protocol analyzer
  • Wireshark
    • About
    • Download
    • Blog
  • Get Help
    • Ask a Question
    • FAQs
    • Documentation
    • Mailing Lists
    • Online Tools
    • Wiki
    • Bug Tracker
  • Develop
    • Get Involved
    • Developer's Guide
    • Browse the Code
    • Latest Builds

Wireshark-dev: [Wireshark-dev] Defending against NULL dissector handles

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next


From: Neil Piercy <Neil.Piercy@xxxxxxxxxxxx>
Date: Wed, 09 Aug 2006 18:25:59 +0100

I've just had a bug in one of our private dissectors which meant that the handle passed to call_dissector was null. This seemed to give varying behavior - on some Windows installations it hit wireshark's in-built exception handling, and displayed that the dissector had an error (correct), but on some installations it just crashed wireshark (not helpful). I _think_ the difference was whether MSVC was installed or not, but on a sample of only 3 machines.

Should call_dissector include explicit null handle checks, and if so, should it:-

a) g_assert - the simple patch attached
b) fallback to doing a data decode (as disabled protocols do)
c) try to invoke the wireshark exception handling for the packet

Or is the correct answer none of the above - the exception handler should already cope ?

Neil
Index: packet.c
===================================================================
--- packet.c	(revision 18852)
+++ packet.c	(working copy)
@@ -1702,6 +1702,7 @@
 {
 	int ret;
 
+	g_assert(handle != NULL);
 	ret = call_dissector_work(handle, tvb, pinfo, tree);
 	if (ret == 0) {
 		/*
  • Follow-Ups:
    • Re: [Wireshark-dev] Defending against NULL dissector handles
      • From: Joerg Mayer
  • Prev by Date: [Wireshark-dev] Small ANSI-637 patch for identifying more Teleservice
  • Next by Date: [Wireshark-dev] Standards supported by dissectors
  • Previous by thread: Re: [Wireshark-dev] Small ANSI-637 patch for identifying more Teleservice
  • Next by thread: Re: [Wireshark-dev] Defending against NULL dissector handles
  • Index(es):
    • Date
    • Thread

Wireshark and the "fin" logo are registered trademarks of the Wireshark Foundation