Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] Crash due to saving capture as pcapng

From: "FIXED-TERM Scholz Tobias (DC-IA/EAI3)" <fixed-term.Tobias.Scholz@xxxxxxxxxxxxxxx>
Date: Thu, 3 Mar 2016 07:53:35 +0000
Hey,
 
I am having problems with saving my new development as a pcapng file. Trying to save with this type, wireshark 2.1.0 (x64) crashes and I will get an exception.
 
Using the VS2013 debugger I get the following exception within “pcapng.c”:
  • Unhandled exception at 0x000007FEE02F7C67 (wiretap-2.1.0(x64_TS_PS).dll) in Wireshark.exe: 0xC0000005: Access violation reading location 0x0000000000000000.
 
The programm itself seems to stop at line 4031 in “pcapng.c”
 
           if (!pcapng_write_interface_statistics_block(wdh, if_stats, err)) {
                return FALSE;
            }
 
What I don’t understand is, trying to save another capture with the same development as pcap works perfect. I can also load the pcap file without any problems. After saving the file as pcap I tried to save the same capture as pcapng, and it works! Due to the fact that I am able to save a capture with my new development as pcap I can’t believe, that my development is responsible for this crash?
 
Is that problem known or should I report a bug? Can someone help me with that issue?
 
Thanks in advance.
 
Regards