ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-users: [Ethereal-users] Fixes for crashes in tethereal version 9.0.x

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Ian Parker" <ian.parker@xxxxxxxxxxxxxx>
Date: Fri, 21 Jun 2002 18:16:45 +0100
I found these problems on Win32, but some are generic.
They appear to be in all version of tethereal 0.9.1+, including the
snapshot ethereal-2002-06-18.


1. tethereal crash on ctrl-C

Bug in capture_cleanup(int signum _U_) in tethereal.c:
Call to

longjmp(ld.stopenv, 1);

crashes as ld.stopenv is an invalid address (it does not appear to have
been initialised)
I have replaced this by:

ld.go = FALSE;

as described in the comment (0.8.x version included this statement
rather than the longjmp)
I will leave it to the author of the longjmp, to privide the definitive
fix.

2. tethereal input file option "-r file" always fails with invalid file
descriptor.

Bug in open_cap_file() in tethereal.c:
The call:

 if (fstat(fd, &cf_stat) < 0) {

Always fails as a file descriptor is being passed when it should be a
FILE pointer.
The wth->fh, FILE pointer does not seem to be available, so the fix is
to call stat(), passing in the file name:

if (stat(fname, &cf_stat) < 0) {


3. The build snapshot, ethereal-2002-06-18, could not have been build on
win32, as various files contain unix only code that needs #ifndef WIN32

4. On at least Windows XP, tethereal crashes when no interface is
specified.
I suspect this is due to the interface enquiry returning the device
description and the device name separated by " : " but tethereal seems
to expect just the device name.
E.g.
Intel(R) PRO Adapter (Microsoft's Packet Scheduler) :
\Device\Packet_{2A0984E8-C12B-4A09-ADF8-20D878C9C0C0}

The crash occurs in the call to p_pcap_open_live() in capture-wpcap.c
within the function p_pcap_open_live().  I have not been able debug
further as this is a call into the wpcap library.

Ian