ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] Segmentation Fault in Simple Dissector-Plugin

From: Patrick Nowak <student.nowak@xxxxxxxxxx>
Date: Wed, 24 Nov 2010 12:33:30 +0100
Hello,

I am fairly new to developing Dissectors for Wireshark. I started with the small sample from the Wireshark Developers Guide and changed a few things(Strings and Port).

My Plugin looks like this:

#ifdef HAVE_CONFIG_H
# include "config.h"
#endif

#include <epan/packet.h>

#define TESTDISSECT_PORT 12345

static int proto_testdissect = -1;

void proto_register_testdissect(void) {
proto_slapml = proto_register_protocol("TestDissectorProtocol", /* name */
   "TestDissector", /* short name */
   "tdissect" /* abbrev     */
   );
}

static void dissect_testdissect(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {
   col_set_str(pinfo->cinfo, COL_PROTOCOL, "TestDissector");

   /* Clear out stuff in the info column */
   col_clear(pinfo->cinfo, COL_INFO);

   if (tree) { /* we are being asked for details */
       proto_item *ti = NULL;
ti = proto_tree_add_item(tree, proto_testdissect, tvb, 0, -1, FALSE);
   }
}

void proto_reg_handoff_testdissect(void) {
   static dissector_handle_t testdissect_handle;

testdissect_handle = create_dissector_handle(dissect_testdissect, proto_testdissect);
   dissector_add("tcp.port", TESTDISSECT_PORT, testdissect_handle);
}

The plugin is working up to a certain point. I generated traffic for the specified port and the text "TestDissector"in the "Protocol"-column is shown. But when I try to select a package, which is dissected by my own dissector, I get a Segmentation Fault at this line "*g_assert(cinfo->col_first[el] >= 0);*" in the method *col_set_str()* of the class *column-utils.c*.

Can anybody tell me, why this happens? Obviously this method-call works the first time, because the text "TestDissector" is shown in the protocol-column. It appears to fail the second time, when this function is called.

Regards,
Patrick