Wireshark · Ethereal-dev: [Ethereal-dev] Crash in latest SVN ethereal (in tvbuff.c, line 583) - in a DCE-RPC over SMB capture

[Yaniv Kaul <ykaul@xxxxxxxxxxxx>]

While trying to perform 'follow TCP stream' on a DCE-RPC over SMB
capture, it crashed on the g_assert in tvb_length_remaining(), tvbuff.c:

    libethereal.dll!tvb_length_remaining(tvbuff * tvb=0x00000000, int
offset=0)  Line 583 + 0x3    C
     libethereal.dll!alloc_field_info(_proto_node * tree=0x025989f8, int
hfindex=20670, tvbuff * tvb=0x00000000, int start=0, int *
length=0x0012db50)  Line 2124 + 0xd    C
     libethereal.dll!proto_tree_add_item(_proto_node * tree=0x025989f8,
int hfindex=20670, tvbuff * tvb=0x00000000, int start=0, int length=0,
int little_endian=0)  Line 670 + 0x19    C
     libethereal.dll!dissect_pipe_smb(tvbuff * sp_tvb=0x00000000, tvbuff
* s_tvb=0x00000000, tvbuff * pd_tvb=0x025ca528, tvbuff *
p_tvb=0x00000000, tvbuff * d_tvb=0x025ca3bc, const char *
pipe=0x00000000, _packet_info * pinfo=0x025f72f0, _proto_node *
tree=0x025989f8)  Line 3554 + 0x1b    C
     libethereal.dll!dissect_transaction_response(tvbuff *
tvb=0x025ca388, _packet_info * pinfo=0x025f72f0, _proto_node *
tree=0x028326d0, int offset=105, _proto_node * smb_tree=0x02832820) 
Line 13510 + 0x25    C
     libethereal.dll!dissect_smb_command(tvbuff * tvb=0x025ca388,
_packet_info * pinfo=0x025f72f0, int offset=32, _proto_node *
smb_tree=0x02832820, unsigned char cmd='%', int first_pdu=1)  Line 13912
+ 0x17    C
     libethereal.dll!dissect_smb(tvbuff * tvb=0x025ca388, _packet_info *
pinfo=0x025f72f0, _proto_node * parent_tree=0x025989f8)  Line 15025 +
0x1d    C
     libethereal.dll!dissect_smb_heur(tvbuff * tvb=0x025ca388,
_packet_info * pinfo=0x025f72f0, _proto_node * parent_tree=0x025989f8) 
Line 15074 + 0x11    C
     libethereal.dll!dissector_try_heuristic(_GSList *
sub_dissectors=0x024477f8, tvbuff * tvb=0x025ca388, _packet_info *
pinfo=0x025f72f0, _proto_node * tree=0x025989f8)  Line 1524 + 0x11    C
     libethereal.dll!dissect_netbios_payload(tvbuff * tvb=0x025ca388,
_packet_info * pinfo=0x025f72f0, _proto_node * tree=0x025989f8)  Line
1041 + 0x17    C
     libethereal.dll!dissect_nbss_packet(tvbuff * tvb=0x025ca354, int
offset=4, _packet_info * pinfo=0x025f72f0, _proto_node *
tree=0x025989f8, int is_cifs=1)  Line 1579 + 0x11    C
     libethereal.dll!dissect_nbss(tvbuff * tvb=0x025ca354, _packet_info
* pinfo=0x025f72f0, _proto_node * tree=0x025989f8)  Line 1763 + 0x19    C
     libethereal.dll!call_dissector_through_handle(dissector_handle *
handle=0x02454428, tvbuff * tvb=0x025ca354, _packet_info *
pinfo=0x025f72f0, _proto_node * tree=0x025989f8)  Line 384 + 0x12    C
     libethereal.dll!call_dissector_work(dissector_handle *
handle=0x02454428, tvbuff * tvb=0x025ca354, _packet_info *
pinfo_arg=0x025f72f0, _proto_node * tree=0x025989f8)  Line 559 + 0x15    C
     libethereal.dll!dissector_try_port(dissector_table *
sub_dissectors=0x024338e8, unsigned int port=445, tvbuff *
tvb=0x025ca354, _packet_info * pinfo=0x025f72f0, _proto_node *
tree=0x025989f8)  Line 834 + 0x15    C
     libethereal.dll!decode_tcp_ports(tvbuff * tvb=0x025ca458, int
offset=20, _packet_info * pinfo=0x025f72f0, _proto_node *
tree=0x025989f8, int src_port=445, int dst_port=4180)  Line 2527 + 0x22    C
     libethereal.dll!process_tcp_payload(tvbuff * tvb=0x025ca458,
volatile int offset=20, _packet_info * pinfo=0x025f72f0, _proto_node *
tree=0x025989f8, _proto_node * tcp_tree=0x025f9028, int src_port=445,
int dst_port=4180, unsigned int seq=0, unsigned int nxtseq=0, int
is_tcp_segment=0)  Line 2575 + 0x23    C
     libethereal.dll!desegment_tcp(tvbuff * tvb=0x025ca458, _packet_info
* pinfo=0x025f72f0, int offset=20, unsigned int seq=1114, unsigned int
nxtseq=1223, unsigned int sport=445, unsigned int dport=4180,
_proto_node * tree=0x025989f8, _proto_node * tcp_tree=0x025f9028)  Line
1745 + 0x27    C
     libethereal.dll!dissect_tcp_payload(tvbuff * tvb=0x025ca458,
_packet_info * pinfo=0x025f72f0, int offset=20, unsigned int seq=1114,
unsigned int nxtseq=1223, unsigned int sport=445, unsigned int
dport=4180, _proto_node * tree=0x025989f8, _proto_node *
tcp_tree=0x025f9028)  Line 2646 + 0x29    C
     libethereal.dll!dissect_tcp(tvbuff * tvb=0x025ca458, _packet_info *
pinfo=0x025f72f0, _proto_node * tree=0x025989f8)  Line 3078 + 0x45    C
     libethereal.dll!call_dissector_through_handle(dissector_handle *
handle=0x02473ae0, tvbuff * tvb=0x025ca458, _packet_info *
pinfo=0x025f72f0, _proto_node * tree=0x025989f8)  Line 384 + 0x12    C
     libethereal.dll!call_dissector_work(dissector_handle *
handle=0x02473ae0, tvbuff * tvb=0x025ca458, _packet_info *
pinfo_arg=0x025f72f0, _proto_node * tree=0x025989f8)  Line 559 + 0x15    C
     libethereal.dll!dissector_try_port(dissector_table *
sub_dissectors=0x020bab80, unsigned int port=6, tvbuff * tvb=0x025ca458,
_packet_info * pinfo=0x025f72f0, _proto_node * tree=0x025989f8)  Line
834 + 0x15    C
     libethereal.dll!dissect_ip(tvbuff * tvb=0x025ca424, _packet_info *
pinfo=0x025f72f0, _proto_node * tree=0x025989f8)  Line 1099 + 0x21    C
     libethereal.dll!call_dissector_through_handle(dissector_handle *
handle=0x020bacd8, tvbuff * tvb=0x025ca424, _packet_info *
pinfo=0x025f72f0, _proto_node * tree=0x025989f8)  Line 384 + 0x12    C
     libethereal.dll!call_dissector_work(dissector_handle *
handle=0x020bacd8, tvbuff * tvb=0x025ca424, _packet_info *
pinfo_arg=0x025f72f0, _proto_node * tree=0x025989f8)  Line 559 + 0x15    C
     libethereal.dll!dissector_try_port(dissector_table *
sub_dissectors=0x020685d8, unsigned int port=2048, tvbuff *
tvb=0x025ca424, _packet_info * pinfo=0x025f72f0, _proto_node *
tree=0x025989f8)  Line 834 + 0x15    C
     libethereal.dll!ethertype(unsigned short etype=2048, tvbuff *
tvb=0x025ca3f0, int offset_after_etype=14, _packet_info *
pinfo=0x025f72f0, _proto_node * tree=0x025989f8, _proto_node *
fh_tree=0x025f8ab8, int etype_id=5238, int trailer_id=5240, int
fcs_len=-1)  Line 185 + 0x22    C
     libethereal.dll!dissect_eth_common(tvbuff * tvb=0x025ca3f0,
_packet_info * pinfo=0x025f72f0, _proto_node * tree=0x025989f8, int
fcs_len=-1)  Line 302 + 0x30    C
     libethereal.dll!dissect_eth_maybefcs(tvbuff * tvb=0x025ca3f0,
_packet_info * pinfo=0x025f72f0, _proto_node * tree=0x025989f8)  Line
396 + 0x1a    C
     libethereal.dll!call_dissector_through_handle(dissector_handle *
handle=0x0244dfd8, tvbuff * tvb=0x025ca3f0, _packet_info *
pinfo=0x025f72f0, _proto_node * tree=0x025989f8)  Line 384 + 0x12    C
     libethereal.dll!call_dissector_work(dissector_handle *
handle=0x0244dfd8, tvbuff * tvb=0x025ca3f0, _packet_info *
pinfo_arg=0x025f72f0, _proto_node * tree=0x025989f8)  Line 559 + 0x15    C
     libethereal.dll!dissector_try_port(dissector_table *
sub_dissectors=0x02083ed0, unsigned int port=1, tvbuff * tvb=0x025ca3f0,
_packet_info * pinfo=0x025f72f0, _proto_node * tree=0x025989f8)  Line
834 + 0x15    C
     libethereal.dll!dissect_frame(tvbuff * tvb=0x025ca3f0, _packet_info
* pinfo=0x025f72f0, _proto_node * tree=0x025989f8)  Line 190 + 0x21    C
     libethereal.dll!call_dissector_through_handle(dissector_handle *
handle=0x02083fc8, tvbuff * tvb=0x025ca3f0, _packet_info *
pinfo=0x025f72f0, _proto_node * tree=0x025989f8)  Line 384 + 0x12    C
     libethereal.dll!call_dissector_work(dissector_handle *
handle=0x02083fc8, tvbuff * tvb=0x025ca3f0, _packet_info *
pinfo_arg=0x025f72f0, _proto_node * tree=0x025989f8)  Line 559 + 0x15    C
     libethereal.dll!call_dissector(dissector_handle *
handle=0x02083fc8, tvbuff * tvb=0x025ca3f0, _packet_info *
pinfo=0x025f72f0, _proto_node * tree=0x025989f8)  Line 1700 + 0x15    C
     libethereal.dll!dissect_packet(_epan_dissect_t * edt=0x025f72e8,
wtap_pseudo_header * pseudo_header=0x004ebe98, const unsigned char *
pd=0x004ebf28, _frame_data * fd=0x025ba7d4, _column_info *
cinfo=0x004fbf3c)  Line 332 + 0x20    C
     libethereal.dll!epan_dissect_run(_epan_dissect_t * edt=0x025f72e8,
void * pseudo_header=0x004ebe98, const unsigned char * data=0x004ebf28,
_frame_data * fd=0x025ba7d4, _column_info * cinfo=0x004fbf3c)  Line 153
+ 0x19    C
     ethereal-gtk2.exe!add_packet_to_packet_list(_frame_data *
fdata=0x025ba7d4, _capture_file * cf=0x004ebe20, wtap_pseudo_header *
pseudo_header=0x004ebe98, const unsigned char * buf=0x004ebf28, int
refilter=1)  Line 769 + 0x1e    C
     ethereal-gtk2.exe!rescan_packets(_capture_file * cf=0x004ebe20,
const char * action=0x004a04dc, const char * action_item=0x0282aae8, int
refilter=1, int redissect=0)  Line 1367 + 0x22    C
     ethereal-gtk2.exe!cf_filter_packets(_capture_file * cf=0x004ebe20,
char * dftext=0x0282aae8, int force=1)  Line 1172 + 0x16    C
     ethereal-gtk2.exe!main_filter_packets(_capture_file *
cf=0x004ebe20, const char * dftext=0x028312f0, int force=1)  Line 525 +
0x11    C
     ethereal-gtk2.exe!follow_stream_cb(_GtkWidget * w=0x02008a78, void
* data=0x024aabe0)  Line 247 + 0x13    C
     libgtk-win32-2.0-0.dll!06dd4259()    
     libgobject-2.0-0.dll!06c985c2()    
     NTDLL.DLL!77f9ff57()    
     libgobject-2.0-0.dll!06c83b62()    
     libgobject-2.0-0.dll!06c97ef7()    
     libgobject-2.0-0.dll!06c97496()    
     SynTPFcs.dll!630015a3()    
     USER32.DLL!77e150aa()    
     USER32.DLL!77e1479a()    
     libgdk-win32-2.0-0.dll!06b7542a()    
     libgdk-win32-2.0-0.dll!06b753b3()    
     libgdk-win32-2.0-0.dll!06b754cf()    
     USER32.DLL!77e3a420()    
     USER32.DLL!77e14750()    
     USER32.DLL!77e155b0()    
     USER32.DLL!77e155c0()    
     NTDLL.DLL!77f9ff57()    
     USER32.DLL!77e146a0()    
     USER32.DLL!77e1482f()    
     libgobject-2.0-0.dll!06c97708()    
     libgtk-win32-2.0-0.dll!06f14849()    
     libglib-2.0-0.dll!06c1b62f()    
     libgtk-win32-2.0-0.dll!06e05a5a()    
     libgtk-win32-2.0-0.dll!06e04bb6()    
     libgtk-win32-2.0-0.dll!06dfc50b()    
     libgtk-win32-2.0-0.dll!06df2d2b()    
     libgobject-2.0-0.dll!06ca60fe()    
     libgobject-2.0-0.dll!06c83e7f()    
     libgobject-2.0-0.dll!06c83b62()    
     libgobject-2.0-0.dll!06c98062()    
     libgobject-2.0-0.dll!06c974fc()