Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 9334] New: Buildbot crash output: fuzz-2013-10-27-4516.pcap

[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	9334
Summary	Buildbot crash output: fuzz-2013-10-27-4516.pcap
Classification	Unclassified
Product	Wireshark
Version	unspecified
Hardware	x86-64
URL	http://www.wireshark.org/download/automated/captures/fuzz-2013-10-27-4516.pcap
OS	Ubuntu
Status	CONFIRMED
Severity	Major
Priority	High
Component	Dissection engine (libwireshark)
Assignee	bugzilla-admin@wireshark.org
Reporter	buildbot-do-not-reply@wireshark.org

Problems have been found with the following capture file:

http://www.wireshark.org/download/automated/captures/fuzz-2013-10-27-4516.pcap

stderr:
Input file: /home/wireshark/menagerie/menagerie/03-13_los_altos.pcap

Build host information:
Linux wsbb04 3.2.0-49-generic #75-Ubuntu SMP Tue Jun 18 17:39:32 UTC 2013
x86_64 x86_64 x86_64 GNU/Linux
Distributor ID:    Ubuntu
Description:    Ubuntu 12.04.2 LTS
Release:    12.04
Codename:    precise

Buildbot information:
BUILDBOT_REPOSITORY=http://code.wireshark.org/git/wireshark
BUILDBOT_BUILDNUMBER=2143
BUILDBOT_URL=http://buildbot.wireshark.org/trunk/
BUILDBOT_BUILDERNAME=Clang-Code-Analysis
BUILDBOT_SLAVENAME=clang-code-analysis
BUILDBOT_GOT_REVISION=2aae7bc4a621b192630efb6c2ffadcfaa69b0a76

Return value:  0

Dissector bug:  0

Valgrind error count:  643



Git commit
commit 2aae7bc4a621b192630efb6c2ffadcfaa69b0a76
Author: Jeff Morriss <jeff.morriss.ws@gmail.com>
Date:   Fri Oct 25 14:15:28 2013 +0000

    Fix CID 280081: ENC_NULL can't be used as an array index into ciphers[],
rather
    ENC_NULL-0x30 needs to be used.

    (This could probably use some cleanup...)

    svn path=/trunk/; revision=52843


Command and args: ./tools/valgrind-wireshark.sh -T

==15570== Memcheck, a memory error detector
==15570== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==15570== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info
==15570== Command:
/home/wireshark/builders/trunk-clang-ca/clangcodeanalysis/install/bin/tshark
-Vx -nr
/fuzz/buildbot/clangcodeanalysis/valgrind-fuzz/fuzz-2013-10-27-4516.pcap
==15570== 
==15570== Conditional jump or move depends on uninitialised value(s)
==15570==    at 0x4C2BFB8: strlen (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==15570==    by 0x95492D1: g_strdup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.3)
==15570==    by 0x64F10CA: string_fvalue_set (ftype-string.c:55)
==15570==    by 0x64BB247: proto_tree_add_string (proto.c:2494)
==15570==    by 0x64BB340: proto_tree_add_string_format (proto.c:2534)
==15570==    by 0x67EC978: dissect_http_message (packet-http.c:2433)
==15570==    by 0x64A8C57: call_dissector_through_handle (packet.c:515)
==15570==    by 0x64A95A4: call_dissector_work (packet.c:609)
==15570==    by 0x64A9F52: dissector_try_uint_new (packet.c:1040)
==15570==    by 0x64A9FA6: dissector_try_uint (packet.c:1066)
==15570==    by 0x6B61C9E: decode_udp_ports (packet-udp.c:366)
==15570==    by 0x6B62329: dissect (packet-udp.c:696)
==15570== 
==15570== Invalid read of size 1
==15570==    at 0x4C2BFB4: strlen (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==15570==    by 0x95492D1: g_strdup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.3)
==15570==    by 0x64F10CA: string_fvalue_set (ftype-string.c:55)
==15570==    by 0x64BB247: proto_tree_add_string (proto.c:2494)
==15570==    by 0x64BB340: proto_tree_add_string_format (proto.c:2534)
==15570==    by 0x67EC978: dissect_http_message (packet-http.c:2433)
==15570==    by 0x67EDA08: dissect_http (packet-http.c:2704)
==15570==    by 0x64A8C57: call_dissector_through_handle (packet.c:515)
==15570==    by 0x64A95A4: call_dissector_work (packet.c:609)
==15570==    by 0x64A9F52: dissector_try_uint_new (packet.c:1040)
==15570==    by 0x64A9FA6: dissector_try_uint (packet.c:1066)
==15570==    by 0x6B32A87: decode_tcp_ports (packet-tcp.c:3853)
==15570==  Address 0xfe8f7b7 is 0 bytes after a block of size 1,191 alloc'd
==15570==    at 0x4C2B6CD: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==15570==    by 0x9534A78: g_malloc (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.3)
==15570==    by 0x64C6BA9: fragment_add_work.isra.7 (reassemble.c:1064)
==15570==    by 0x64C6FA3: fragment_add_common (reassemble.c:1371)
==15570==    by 0x64C7787: fragment_add (reassemble.c:1391)
==15570==    by 0x6B33274: dissect_tcp_payload (packet-tcp.c:1713)
==15570==    by 0x6B349B0: dissect_tcp (packet-tcp.c:4779)
==15570==    by 0x64A8C57: call_dissector_through_handle (packet.c:515)
==15570==    by 0x64A95A4: call_dissector_work (packet.c:609)
==15570==    by 0x64A9F52: dissector_try_uint_new (packet.c:1040)
==15570==    by 0x64A9FA6: dissector_try_uint (packet.c:1066)
==15570==    by 0x683CB5F: dissect_ip (packet-ip.c:2396)
==15570== 
==15570== Invalid read of size 1
==15570==    at 0x4C2D1A0: memcpy@@GLIBC_2.14 (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==15570==    by 0x95492EE: g_strdup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.3)
==15570==    by 0x64F10CA: string_fvalue_set (ftype-string.c:55)
==15570==    by 0x64BB247: proto_tree_add_string (proto.c:2494)
==15570==    by 0x64BB340: proto_tree_add_string_format (proto.c:2534)
==15570==    by 0x67EC978: dissect_http_message (packet-http.c:2433)
==15570==    by 0x67EDA08: dissect_http (packet-http.c:2704)
==15570==    by 0x64A8C57: call_dissector_through_handle (packet.c:515)
==15570==    by 0x64A95A4: call_dissector_work (packet.c:609)
==15570==    by 0x64A9F52: dissector_try_uint_new (packet.c:1040)
==15570==    by 0x64A9FA6: dissector_try_uint (packet.c:1066)
==15570==    by 0x6B32A87: decode_tcp_ports (packet-tcp.c:3853)
==15570==  Address 0xfe8f7b7 is 0 bytes after a block of size 1,191 alloc'd
==15570==    at 0x4C2B6CD: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==15570==    by 0x9534A78: g_malloc (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.3)
==15570==    by 0x64C6BA9: fragment_add_work.isra.7 (reassemble.c:1064)
==15570==    by 0x64C6FA3: fragment_add_common (reassemble.c:1371)
==15570==    by 0x64C7787: fragment_add (reassemble.c:1391)
==15570==    by 0x6B33274: dissect_tcp_payload (packet-tcp.c:1713)
==15570==    by 0x6B349B0: dissect_tcp (packet-tcp.c:4779)
==15570==    by 0x64A8C57: call_dissector_through_handle (packet.c:515)
==15570==    by 0x64A95A4: call_dissector_work (packet.c:609)
==15570==    by 0x64A9F52: dissector_try_uint_new (packet.c:1040)
==15570==    by 0x64A9FA6: dissector_try_uint (packet.c:1066)
==15570==    by 0x683CB5F: dissect_ip (packet-ip.c:2396)
==15570== 
==15570== Invalid read of size 2
==15570==    at 0x4C2D160: memcpy@@GLIBC_2.14 (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==15570==    by 0x95492EE: g_strdup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.3)
==15570==    by 0x64F10CA: string_fvalue_set (ftype-string.c:55)
==15570==    by 0x64BB247: proto_tree_add_string (proto.c:2494)
==15570==    by 0x64BB340: proto_tree_add_string_format (proto.c:2534)
==15570==    by 0x67EC978: dissect_http_message (packet-http.c:2433)
==15570==    by 0x67EDA08: dissect_http (packet-http.c:2704)
==15570==    by 0x64A8C57: call_dissector_through_handle (packet.c:515)
==15570==    by 0x64A95A4: call_dissector_work (packet.c:609)
==15570==    by 0x64A9F52: dissector_try_uint_new (packet.c:1040)
==15570==    by 0x64A9FA6: dissector_try_uint (packet.c:1066)
==15570==    by 0x6B32A87: decode_tcp_ports (packet-tcp.c:3853)
==15570==  Address 0xfe8f7b6 is 1,190 bytes inside a block of size 1,191
alloc'd
==15570==    at 0x4C2B6CD: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==15570==    by 0x9534A78: g_malloc (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.3)
==15570==    by 0x64C6BA9: fragment_add_work.isra.7 (reassemble.c:1064)
==15570==    by 0x64C6FA3: fragment_add_common (reassemble.c:1371)
==15570==    by 0x64C7787: fragment_add (reassemble.c:1391)
==15570==    by 0x6B33274: dissect_tcp_payload (packet-tcp.c:1713)
==15570==    by 0x6B349B0: dissect_tcp (packet-tcp.c:4779)
==15570==    by 0x64A8C57: call_dissector_through_handle (packet.c:515)
==15570==    by 0x64A95A4: call_dissector_work (packet.c:609)
==15570==    by 0x64A9F52: dissector_try_uint_new (packet.c:1040)
==15570==    by 0x64A9FA6: dissector_try_uint (packet.c:1066)
==15570==    by 0x683CB5F: dissect_ip (packet-ip.c:2396)
==15570== 
==15570== Invalid read of size 1
==15570==    at 0x4C2D08F: memcpy@@GLIBC_2.14 (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==15570==    by 0x95492EE: g_strdup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.3)
==15570==    by 0x64F10CA: string_fvalue_set (ftype-string.c:55)
==15570==    by 0x64BB247: proto_tree_add_string (proto.c:2494)
==15570==    by 0x64BB340: proto_tree_add_string_format (proto.c:2534)
==15570==    by 0x67EC978: dissect_http_message (packet-http.c:2433)
==15570==    by 0x67EDA08: dissect_http (packet-http.c:2704)
==15570==    by 0x64A8C57: call_dissector_through_handle (packet.c:515)
==15570==    by 0x64A95A4: call_dissector_work (packet.c:609)
==15570==    by 0x64A9F52: dissector_try_uint_new (packet.c:1040)
==15570==    by 0x64A9FA6: dissector_try_uint (packet.c:1066)
==15570==    by 0x6B32A87: decode_tcp_ports (packet-tcp.c:3853)
==15570==  Address 0xf394765 is 0 bytes after a block of size 325 alloc'd
==15570==    at 0x4C2B6CD: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==15570==    by 0x9534A78: g_malloc (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.3)
==15570==    by 0x64C6BA9: fragment_add_work.isra.7 (reassemble.c:1064)
==15570==    by 0x64C6FA3: fragment_add_common (reassemble.c:1371)
==15570==    by 0x64C7787: fragment_add (reassemble.c:1391)
==15570==    by 0x6B33274: dissect_tcp_payload (packet-tcp.c:1713)
==15570==    by 0x6B349B0: dissect_tcp (packet-tcp.c:4779)
==15570==    by 0x64A8C57: call_dissector_through_handle (packet.c:515)
==15570==    by 0x64A95A4: call_dissector_work (packet.c:609)
==15570==    by 0x64A9F52: dissector_try_uint_new (packet.c:1040)
==15570==    by 0x64A9FA6: dissector_try_uint (packet.c:1066)
==15570==    by 0x683CB5F: dissect_ip (packet-ip.c:2396)
==15570== 
==15570== Invalid read of size 1
==15570==    at 0x4C2D080: memcpy@@GLIBC_2.14 (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==15570==    by 0x95492EE: g_strdup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.3)
==15570==    by 0x64F10CA: string_fvalue_set (ftype-string.c:55)
==15570==    by 0x64BB247: proto_tree_add_string (proto.c:2494)
==15570==    by 0x64BB340: proto_tree_add_string_format (proto.c:2534)
==15570==    by 0x67EC978: dissect_http_message (packet-http.c:2433)
==15570==    by 0x67EDA08: dissect_http (packet-http.c:2704)
==15570==    by 0x64A8C57: call_dissector_through_handle (packet.c:515)
==15570==    by 0x64A95A4: call_dissector_work (packet.c:609)
==15570==    by 0x64A9F52: dissector_try_uint_new (packet.c:1040)
==15570==    by 0x64A9FA6: dissector_try_uint (packet.c:1066)
==15570==    by 0x6B32A87: decode_tcp_ports (packet-tcp.c:3853)
==15570==  Address 0xf394766 is 1 bytes after a block of size 325 alloc'd
==15570==    at 0x4C2B6CD: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==15570==    by 0x9534A78: g_malloc (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.3)
==15570==    by 0x64C6BA9: fragment_add_work.isra.7 (reassemble.c:1064)
==15570==    by 0x64C6FA3: fragment_add_common (reassemble.c:1371)
==15570==    by 0x64C7787: fragment_add (reassemble.c:1391)
==15570==    by 0x6B33274: dissect_tcp_payload (packet-tcp.c:1713)
==15570==    by 0x6B349B0: dissect_tcp (packet-tcp.c:4779)
==15570==    by 0x64A8C57: call_dissector_through_handle (packet.c:515)
==15570==    by 0x64A95A4: call_dissector_work (packet.c:609)
==15570==    by 0x64A9F52: dissector_try_uint_new (packet.c:1040)
==15570==    by 0x64A9FA6: dissector_try_uint (packet.c:1066)
==15570==    by 0x683CB5F: dissect_ip (packet-ip.c:2396)
==15570== 
==15570== Invalid read of size 2
==15570==    at 0x4C2D060: memcpy@@GLIBC_2.14 (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==15570==    by 0x95492EE: g_strdup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.3)
==15570==    by 0x64F10CA: string_fvalue_set (ftype-string.c:55)
==15570==    by 0x64BB247: proto_tree_add_string (proto.c:2494)
==15570==    by 0x64BB340: proto_tree_add_string_format (proto.c:2534)
==15570==    by 0x67ED15D: dissect_http_message (packet-http.c:2369)
==15570==    by 0x67EDA08: dissect_http (packet-http.c:2704)
==15570==    by 0x64A8C57: call_dissector_through_handle (packet.c:515)
==15570==    by 0x64A95A4: call_dissector_work (packet.c:609)
==15570==    by 0x64A9F52: dissector_try_uint_new (packet.c:1040)
==15570==    by 0x64A9FA6: dissector_try_uint (packet.c:1066)
==15570==    by 0x6B32A5C: decode_tcp_ports (packet-tcp.c:3867)
==15570==  Address 0x1186bbcc is 172 bytes inside a block of size 173 alloc'd
==15570==    at 0x4C2B6CD: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==15570==    by 0x9534A78: g_malloc (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.3)
==15570==    by 0x64C6BA9: fragment_add_work.isra.7 (reassemble.c:1064)
==15570==    by 0x64C6FA3: fragment_add_common (reassemble.c:1371)
==15570==    by 0x64C7787: fragment_add (reassemble.c:1391)
==15570==    by 0x6B3525E: dissect_tcp (packet-tcp.c:4686)
==15570==    by 0x64A8C57: call_dissector_through_handle (packet.c:515)
==15570==    by 0x64A95A4: call_dissector_work (packet.c:609)
==15570==    by 0x64A9F52: dissector_try_uint_new (packet.c:1040)
==15570==    by 0x64A9FA6: dissector_try_uint (packet.c:1066)
==15570==    by 0x683CB5F: dissect_ip (packet-ip.c:2396)
==15570==    by 0x64A8C57: call_dissector_through_handle (packet.c:515)
==15570== 
==15570== Invalid read of size 2
==15570==    at 0x4C2D050: memcpy@@GLIBC_2.14 (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==15570==    by 0x95492EE: g_strdup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.3)
==15570==    by 0x64F10CA: string_fvalue_set (ftype-string.c:55)
==15570==    by 0x64BB247: proto_tree_add_string (proto.c:2494)
==15570==    by 0x64BB340: proto_tree_add_string_format (proto.c:2534)
==15570==    by 0x67EC978: dissect_http_message (packet-http.c:2433)
==15570==    by 0x67EDA08: dissect_http (packet-http.c:2704)
==15570==    by 0x64A8C57: call_dissector_through_handle (packet.c:515)
==15570==    by 0x64A95A4: call_dissector_work (packet.c:609)
==15570==    by 0x64A9F52: dissector_try_uint_new (packet.c:1040)
==15570==    by 0x64A9FA6: dissector_try_uint (packet.c:1066)
==15570==    by 0x6B32A5C: decode_tcp_ports (packet-tcp.c:3867)
==15570==  Address 0x1186bbcc is 172 bytes inside a block of size 173 alloc'd
==15570==    at 0x4C2B6CD: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==15570==    by 0x9534A78: g_malloc (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.3)
==15570==    by 0x64C6BA9: fragment_add_work.isra.7 (reassemble.c:1064)
==15570==    by 0x64C6FA3: fragment_add_common (reassemble.c:1371)
==15570==    by 0x64C7787: fragment_add (reassemble.c:1391)
==15570==    by 0x6B3525E: dissect_tcp (packet-tcp.c:4686)
==15570==    by 0x64A8C57: call_dissector_through_handle (packet.c:515)
==15570==    by 0x64A95A4: call_dissector_work (packet.c:609)
==15570==    by 0x64A9F52: dissector_try_uint_new (packet.c:1040)
==15570==    by 0x64A9FA6: dissector_try_uint (packet.c:1066)
==15570==    by 0x683CB5F: dissect_ip (packet-ip.c:2396)
==15570==    by 0x64A8C57: call_dissector_through_handle (packet.c:515)
==15570== 
==15570== Invalid read of size 1
==15570==    at 0x4C2D1AD: memcpy@@GLIBC_2.14 (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==15570==    by 0x95492EE: g_strdup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.3)
==15570==    by 0x64F10CA: string_fvalue_set (ftype-string.c:55)
==15570==    by 0x64BB247: proto_tree_add_string (proto.c:2494)
==15570==    by 0x64BB340: proto_tree_add_string_format (proto.c:2534)
==15570==    by 0x67EC978: dissect_http_message (packet-http.c:2433)
==15570==    by 0x67EDA08: dissect_http (packet-http.c:2704)
==15570==    by 0x64A8C57: call_dissector_through_handle (packet.c:515)
==15570==    by 0x64A95A4: call_dissector_work (packet.c:609)
==15570==    by 0x64A9F52: dissector_try_uint_new (packet.c:1040)
==15570==    by 0x64A9FA6: dissector_try_uint (packet.c:1066)
==15570==    by 0x6B32A87: decode_tcp_ports (packet-tcp.c:3853)
==15570==  Address 0xf64c2be is not stack'd, malloc'd or (recently) free'd
==15570== 
==15570== 
==15570== HEAP SUMMARY:
==15570==     in use at exit: 439,267 bytes in 7,384 blocks
==15570==   total heap usage: 8,830,434 allocs, 8,823,050 frees, 819,980,390
bytes allocated
==15570== 
==15570== LEAK SUMMARY:
==15570==    definitely lost: 8,167 bytes in 1,595 blocks
==15570==    indirectly lost: 1,416 bytes in 52 blocks
==15570==      possibly lost: 0 bytes in 0 blocks
==15570==    still reachable: 429,684 bytes in 5,737 blocks
==15570==         suppressed: 0 bytes in 0 blocks
==15570== Rerun with --leak-check=full to see details of leaked memory
==15570== 
==15570== For counts of detected and suppressed errors, rerun with: -v
==15570== Use --track-origins=yes to see where uninitialised values come from
==15570== ERROR SUMMARY: 643 errors from 9 contexts (suppressed: 15 from 5)

[ no debug trace ]

---

      You are receiving this mail because:

• You are watching all bug changes.