Wireshark-dev: Re: [Wireshark-dev] Finding the bug in the unistim dissector
From: Jaap Keuter <[email protected]>
Date: Wed, 15 Aug 2007 21:29:28 +0200

Yeah, that was my first idea as well. Finding the object that gets altered isn't so easy though. Looking back at the code there are just your basic proto_tree_add_* calls, but there are two extra display handling functions which look oke, but may be the cause after all....

Luis EG Ontanon wrote:
Might be a buffer overflow overwriting it.

- break after protocol registration.
- find the object that gets altered,
- set a watchpoint on that memory location
- continue until the watchpoint tells you who and where it gets overwritten.


On 8/15/07, Jaap Keuter <[email protected]> wrote:
Hi list,

I've picked up the unistim dissector a while ago and try getting it into
shape for checkin. Thing is that I'm currently running fuzztests which
for the most run fine, but now I've isolated a packet that causes a
segmentation fault. The problem is that I'm stuck looking for the cause.