Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 6091] New: Crash when clearing http.set_cookie filter

Date: Mon, 4 Jul 2011 04:43:30 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6091

           Summary: Crash when clearing http.set_cookie filter
           Product: Wireshark
           Version: 1.6.0
          Platform: x86
        OS/Version: Windows XP
            Status: NEW
          Severity: Major
          Priority: Low
         Component: Wireshark
        AssignedTo: bugzilla-admin@xxxxxxxxxxxxx
        ReportedBy: wiresharkbug@xxxxxxxxx


Build Information:
Version 1.6.0rc2 (SVN Rev 37523 from /trunk-1.6)

Copyright 1998-2011 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (32-bit) with GTK+ 2.22.1, with GLib 2.26.1, with WinPcap (version
unknown), with libz 1.2.5, without POSIX capabilities, without libpcre, with
SMI
0.4.8, with c-ares 1.7.1, with Lua 5.1, without Python, with GnuTLS 2.10.3,
with
Gcrypt 1.4.6, with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built
Jun
 2 2011), with AirPcap.

Running on Windows XP Service Pack 3, build 2600, with WinPcap version 4.1.2
(packet.dll version 4.1.0.2001), based on libpcap version 1.0 branch 1_0_rel0b
(20091008), GnuTLS 2.10.3, Gcrypt 1.4.6, without AirPcap.

Built using Microsoft Visual C++ 9.0 build 21022

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information.
--
Short Description:
------------------
Wireshark crashes when trying to clear a filter either by pressing the "Clear"
button or erasing the filter text and pressing enter. 




My Findings:
------------

The crash seems data dependent since it doesn't happen for all captures or even
all http lines within a capture.

The crash only appears when the "right" packet has been selected prior to
clearing the filter




How to Reproduce:
-----------------

Unfortunately I'm unable to provide you with a capture file, but if you follow
these directions you might be able to create a capture that can be used to
invoke the crash:

1) Log into a Hotmail.com account (without HTTPS) (I used Chrome, probably not
necessary)
2) Start capturing
3) Press "Sign Out" to sign out from Hotmail
4) Wait for redirect to finish loading
5) Stop and save capture
6) The response to "GET http://login.live.com/logout.srf?ct=..."; can be used to
invoke the problem in my capture. 

To invoke the crash:
1) Load the capture file
2) Type "http.set_cookie" (without quotes) in the filter text field and press
enter
3) Select the packet that will cause the crash (see item 6 above)
4) Click the "Clear" button
5) Wait a few secs for the crash to appear




Additional Info:
----------------

I've seen the crash in both 1.6.0 (SVN Rev 37592 from /trunk-1.6) and 1.6.0rc2
(SVN Rev 37523 from /trunk-1.6).
Further more, the crash has been observed on several PCs running Windows XP
(32-bit, Intel Pentium 4 / Intel Core 2 Duo, between 1 and 3 GB RAM).

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.