Wireshark-dev: Re: [Wireshark-dev] Ideas regarding bug 1025?
From: Joerg Mayer <[email protected]>
Date: Thu, 10 Aug 2006 10:43:34 +0200
On Fri, Aug 04, 2006 at 12:56:11PM +0100, Neil Piercy wrote:
> same execution path in this area. The big difference between the request 
> and the response is that the _values_ of the 64 bit monotonic replay 
> detection counter: the requests use very small values, the responses use 
> huge values (i.e. all bytes of the 64 bit values are non-zero).

Nice find! It has MSB set.

> The crash definitely happens deep in the glib handling of the 
> g_vsnprintf - I dont have a debug build of glib, but it looked like it 
> went into the guts of the core gnulib/vasnprintf, where it hit an abort 
> call. Without the debug lib it is difficult to see where or why.
> Bottom line: looks to me like a glib bug or a build incompatibility 
> between guint64 handling in the glib binary and ethereal perhaps?

OK, I've created a small testprogram (under Suse 10.1) which you should
compile as similar as possible to the way you compile Wireshark. Let's
see whether it crashes and if so, where. I hope the program doesn't much
tweaking to compile on W32.

Joerg Mayer                                           <[email protected]>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.
/* Testprogram for http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1025
 * Compile with:
 * gcc -Wall `pkg-config --cflags glib-2.0` `pkg-config --libs glib-2.0` -o gtest64  gtest64.c
 * which expands on my system to
 * gcc -Wall -I/opt/gnome/include/glib-2.0 -I/opt/gnome/lib/glib-2.0/include -L/opt/gnome/lib -lglib-2.0 -o gtest64  gtest64.c

 * Finally, run with ./gtest64 or something like that.

#include <glib.h>
#include <glib/gprintf.h>

/* Formats for printing 64-bit unsigned hexadecimal numbers */
#ifndef PRIx64
#define PRIx64  "I64x"
#else /* _MSC_EXTENSIONS */
#define PRIx64  "llx"
#endif /* _MSC_EXTENSIONS */
#endif /* PRIx64 */

#define BUFLEN 100
char buffer[BUFLEN];

guint64 test1 = G_GINT64_CONSTANT(0x11223344U);
guint64 test2 = G_GINT64_CONSTANT(0x11223344556677U);
guint64 test3 = G_GINT64_CONSTANT(0x1122334455667788U);
guint64 test4 = G_GINT64_CONSTANT(0xFFEEDDCC11223344U);

printit(const char *format, ...)
	va_list ap;

	va_start(ap, format);
	g_vsnprintf(buffer, BUFLEN, format, ap);
	g_printf("%s\n", buffer);

int main() {
	printit("Test1: %" PRIx64 , test1);
	printit("Test2: %" PRIx64 , test2);
	printit("Test3: %" PRIx64 , test3);
	printit("Test4: %" PRIx64 , test4);
	return 0;