Wireshark-dev: [Wireshark-dev] Crash during fuzzing
From: Dario Lombardo <[email protected]>
Date: Mon, 10 Aug 2015 21:52:55 +0200
Hi list
II was fuzzing a protocol, and I experienced a crash. The fuzz-test.sh gave me this output

$ ../tools/fuzz-test.sh -b run ../data/hpfeed_all_packets_sample.pcap 
[...]
Starting pass 130:
    ../data/hpfeeds_all_packets_sample.pcap: (-nVxr) (-nr)  OK
Starting pass 131:
    ../data/hpfeeds_all_packets_sample.pcap: (-nVxr) (-nr)  OK
Starting pass 132:
    ../data/hpfeeds_all_packets_sample.pcap: (-nVxr) (-nr)  OK
Starting pass 133:
    ../data/hpfeeds_all_packets_sample.pcap: (-nVxr) ../tools/fuzz-test.sh: line 189:  8725 Segmentation fault      (core dumped) "$RUNNER" $COMMON_ARGS $ARGS $TMP_DIR/$TMP_FILE > /dev/null 2>> $TMP_DIR/$ERR_FILE

 ERROR
Processing failed. Capture info follows:

  Input file: ../data/hpfeed_all_packets_sample.pcap
  Output file: /tmp/fuzz-2015-08-10-7120.pcap

stderr follows:

Input file: ../data/hpfeed_all_packets_sample.pcap

Build host information:
Linux hardcore 3.13.0-61-generic #100-Ubuntu SMP Wed Jul 29 11:21:34 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
Distributor ID: Ubuntu
Description: Ubuntu 14.04.3 LTS
Release: 14.04
Codename: trusty

Return value:  139

Dissector bug:  0

Valgrind error count:  0




Command and args: run/tshark -nVxr

**
ERROR:../epan/wmem/wmem_allocator_strict.c:77:wmem_strict_block_check_canaries: assertion failed: (canary[i] == WMEM_CANARY_VALUE)

So I tried to reproduce the error, but when I issued

run/tshark -nVxr /tmp/fuzz-2015-08-10-7120.pcap

no crash happened. Is this the right way to reproduce a bug the fuzzer found? If yes, why it is not crashing?
Thanks for your suggestions.
Dario.