Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] repeatable crash in tshark, but can't reproduce standalone

From: Sam Roberts <vieuxtech@xxxxxxxxx>
Date: Fri, 19 Jun 2009 17:15:30 -0700
This isn't critical for us, and I haven't been able to reproduce it by
running tshark standalone, and its an old tshark version... but I
thought I'd report this in case anybody knows what's going on.

We run tshark from inside a python/twisted exe, that's running as
root. If I run from the command line, then ctrl-C/SIGINT, tshark
crashes, every time.

I don't think it crashes with my local build from svn.

Anyhow, this is what we get:

2009/06/19 16:55 -0700 [-] Received SIGINT, shutting down.
*** glibc detected *** /usr/bin/tshark: double free or corruption
(!prev): 0x0000000000e0b2f0 ***
======= Backtrace: =========
/lib/libc.so.6[0x2b7f3317fb0a]
/lib/libc.so.6(cfree+0x8c)[0x2b7f331836fc]
/usr/lib/libpcap.so.0.8(pcap_close_common+0x15)[0x2b7f31b11005]
/usr/lib/libpcap.so.0.8[0x2b7f31b0f3e7]
/usr/lib/libpcap.so.0.8(pcap_close+0xa)[0x2b7f31b10dca]
/usr/bin/tshark[0x41d62f]
/usr/bin/tshark(main+0x126a)[0x41ec9a]
/lib/libc.so.6(__libc_start_main+0xf4)[0x2b7f3312bb44]
/usr/bin/tshark(register_all_protocol_handoffs+0x901)[0x409dd9]


TShark 0.99.6

Copyright 1998-2007 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GLib 2.14.1, with libpcap 0.9.7, with libz 1.2.3.3, with libpcre
7.4, without Net-SNMP, with ADNS, without Lua, with GnuTLS 1.6.3, with Gcrypt
1.2.4, with MIT Kerberos.

Running on Linux 2.6.22-16-generic, with libpcap version 0.9.7.

Built using gcc 4.1.3 20070929 (prerelease) (Ubuntu 4.1.2-16ubuntu2).