Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 9885] Buildbot crash output: fuzz-2014-03-14-15333.pcap

Date: Sun, 16 Mar 2014 06:33:02 +0000

Comment # 3 on bug 9885 from
Notes to self:

The reason the RTP packet matches a conversation (which it shouldn't) is
because RTP dissector sets up a wildcarded conversation... but conversations
have no concept of wildcarding sources vs. destinations really - the
conversation matching logic will match a packet to a wildcard entry based on
its source addr:port OR its dest addr:port. So here we have a packet of a
source addr:port that matches a wildcard entry, even though RTP really intended
it to be a *dest* addr:port wildcard entry only.

Unfortunately, if this is fixed (ie, if conversation matching is enhanced to
offer specifying only match wildcard for a specific direction), that will break
our ability to decode RTP from SIP latching scenarios. So this behavior is ok.

Also, the stack trace above is misleading - the line numbers for packet-rtp.c
are a bit off as I ran that with debug printing code that doesn't exist in
master.


You are receiving this mail because:
  • You are watching all bug changes.