ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-bugs: [Wireshark-bugs] [Bug 9072] Enhancement of the packet-mq dissector (WMQ 7.1-7.5)

Date: Tue, 10 Sep 2013 20:26:05 +0000

Comment # 20 on bug 9072 from
(In reply to comment #19)

Hi,

if you add an error at the begining of 

static gboolean dissect_mq_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree
*tree, gint iProto, void *data _U_)
{
    int x=5;
    int y=0;

    x/=y;

for example, when trying to dissect a MQ packet, the debugger stops at this
instruction with an access violation.

If I continue to the next instruction (return top), the pgm continue but every
packet is displayed

[Dissector bug, protocol MQ: STATUS_INTEGER_DIVIDE_BY_ZERO: dissector tried an
integer division by zero]

and i'm able to stop the pgm.

If i put the if (top), then there is no more access violation, and the pgm
display all mq packet with the error

Here the access violation:
Unhandled exception at 0x000007FED1CB9F43 (libwireshark.dll) in Wireshark.exe:
0xC0000005: Access violation reading location 0xFFFFFFFFFFFFFFFF.

Here the Call Stack:
>	libwireshark.dll!except_pop() Line 267	C
     Wireshark.exe!cf_read(_capture_file * cf=0x000000014014cb80, int
reloading=0x00000000) Line 716    C
     Wireshark.exe!menu_open_recent_file_cmd(_GtkAction *
action="" Line 4283    C
     Wireshark.exe!menu_open_recent_file_cmd_cb(_GtkAction *
action="" void * data="" Line 4303    C
     libgobject-2.0-0.dll!g_closure_invoke() + 329 bytes    Unknown
     libgobject-2.0-0.dll!g_signal_handler_disconnect() + 3351 bytes    Unknown
     libgobject-2.0-0.dll!g_signal_emit_valist() + 2634 bytes    Unknown
     libgobject-2.0-0.dll!g_signal_emit() + 24 bytes    Unknown
     libgtk-win32-2.0-0.dll!gtk_action_new() + 223 bytes    Unknown
     libgobject-2.0-0.dll!g_closure_invoke() + 950 bytes    Unknown
     libgobject-2.0-0.dll!g_signal_emit_valist() + 1023 bytes    Unknown
     libgobject-2.0-0.dll!g_signal_emit() + 24 bytes    Unknown
     libgtk-win32-2.0-0.dll!gtk_widget_activate() + 112 bytes    Unknown
     libgtk-win32-2.0-0.dll!gtk_menu_shell_activate_item() + 253 bytes   
Unknown
     libgtk-win32-2.0-0.dll!gtk_menu_shell_activate_item() + 1099 bytes   
Unknown
     libgtk-win32-2.0-0.dll!gtk_marshal_VOID__UINT_STRING() + 279 bytes   
Unknown
     libgobject-2.0-0.dll!g_closure_invoke() + 329 bytes    Unknown
     libgobject-2.0-0.dll!g_signal_handler_disconnect() + 2729 bytes    Unknown
     libgobject-2.0-0.dll!g_signal_emit_valist() + 2052 bytes    Unknown
     libgobject-2.0-0.dll!g_signal_emit() + 24 bytes    Unknown
     libgtk-win32-2.0-0.dll!gtk_widget_get_realized() + 557 bytes    Unknown
     libgtk-win32-2.0-0.dll!gtk_propagate_event() + 193 bytes    Unknown
     libgtk-win32-2.0-0.dll!gtk_main_do_event() + 603 bytes    Unknown
     libgdk-win32-2.0-0.dll!gdk_event_get_graphics_expose() + 10027 bytes   
Unknown
     libglib-2.0-0.dll!g_main_context_dispatch() + 278 bytes    Unknown
     libglib-2.0-0.dll!g_main_context_dispatch() + 1064 bytes    Unknown
     libglib-2.0-0.dll!g_main_loop_run() + 115 bytes    Unknown
     libgtk-win32-2.0-0.dll!gtk_main() + 158 bytes    Unknown
     Wireshark.exe!main(int argc=0x00000000, char * * argv=0x00000000004a88c8)
Line 3200    C
     Wireshark.exe!WinMain(HINSTANCE__ * hInstance=0x000000013fe90000,
HINSTANCE__ * hPrevInstance=0x0000000000000000, char *
lpszCmdLine=0x0000000000495a03, int nCmdShow=0x0000000a) Line 3272    C
     Wireshark.exe!__tmainCRTStartup() Line 528    C
     kernel32.dll!BaseThreadInitThunk()    Unknown
     ntdll.dll!RtlUserThreadStart()    Unknown

So, it seems that somewhere the exception are not yet fully initialized, and
the test with the if (top) remove the exception

RobiOneKenobi

> Comment on attachment 11515 [details]
> correct an access violation if top is null
> 
> My understanding is that if top ends up NULL in this function then you are
> misusing the exception API somehow - how are you triggering this?


You are receiving this mail because:
  • You are watching all bug changes.