ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] VALS macro causing Wireshark to crash on Windows

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 6 Aug 2008 16:10:50 -0700

On Aug 6, 2008, at 4:00 PM, Chih Wang wrote:

	static const value_string msgtypenames[] = {
	  { 0x10, "Type 16" },
	  { 0x01, "Type 1" },
	  { 0x03, "Type 3" },
	  { 0x05, "Type 5"}
	};

A value_string array *must* be terminated with an end-of-list entry:

	static const value_string msgtypenames[] = {
	  { 0x10, "Type 16" },
	  { 0x01, "Type 1" },
	  { 0x03, "Type 3" },
	  { 0x05, "Type 5"},
	  { 0, NULL }
	};

Otherwise, code in Wireshark might run past the end of the array and refer to data that's not part of the array as if it were part of the array, which can, for example, cause non-pointer data to be dereferenced as if it were a pointer.

There's nothing Windows-specific about that; if it worked on some other operating system, that was purely by luck.