Wireshark-dev: [Wireshark-dev] Wireshark crash after removing if(tree)
From: Raj sekar <[email protected]>
Date: Fri, 27 Feb 2015 21:38:03 +0800


I am developing custom dissector and i was having issues on reassembly

with help from PASCAL i have found my reassembly is not working because of if(tree) and if i remove if(tree) i can able to open my pcap file only in debug mode (Edit -> preference -> console window = always debugging). and i can able to see my reassembly successful. but not in normal mode.

i ran MSVC debugger and found the error in trees

in dissect function under if(tree)

iam calling functions  8+ different functions. in debuggger i could see all my sub trees and other trees returning error

ALL trees getting CXX0030 ERROR Mnt tree 0x00000000 null pointer. First child ???? Last child ???? Next ???? Parent ???? Fino ???? Data ????

All the trees have this same error.

my code is some thing like this

dissect function { if (tree){ call function1(passed tree); call function2(passed tree); } } function1 (){ used tree created subtree function3 (passed subtree) } function2(){ used tree created subtree function4 (passed subtree) } function 4(){ reassembly code here.. }

I have used wireshark build 1.11.3 and also i hae tried 1.12.3 both are getting same issue .

Some one please suggest what i can do with this ? any suggestions to overcome from this.

I have posted the question here


Please help.


Best Regards