[Stekrt Michal <Michal.Stekrt@xxxxxxxxxxx>]

Hi,
I think I have found a bug in ethereal TNS dissector. When I try to load
attached packet then ethereal crashes. I am pasting also last part of
backtrace. I have tested this frame to load on old 8.2.0 version and with
last
cvs i have compiled myself.  It crashes on both ( linux & win )


Also I saw following line in printed out on stderr:

** ERROR **: file proto.c: line 1115 (proto_tree_add_string): assertion
failed:
(hfinfo->type == FT_STRING)
aborting...
Aborted


Program received signal SIGABRT, Aborted.
0x40313911 in kill () from /lib/libc.so.6
(gdb) bt
#0  0x40313911 in kill () from /lib/libc.so.6
#1  0x403135f4 in raise () from /lib/libc.so.6
#2  0x40314d71 in abort () from /lib/libc.so.6
#3  0x401aecfe in g_logv () from /usr/lib/libglib-1.2.so.0
#4  0x401aedb1 in g_log () from /usr/lib/libglib-1.2.so.0
#5  0x081c8d07 in proto_tree_add_string (tree=0x83f78cc, hfindex=5049,
tvb=0x83fa6b4, start=10, length=577, value=0x833a3e4 "ther system trap CPU
time\001\200\a\003Â\003\017\035OS Text page fault sleep
time\001\200\a\003Â\003\020\035OS Data page fault sleep
time\001\200\a\003Â\003\021\037OS Kernel page fault sleep
time\001\200\a\003Â\003\022\034OS User lock wait sleep
time\001\200\a\003Â\003\023\027OS All other sleep"...) at proto.c:1115
#6  0x0814f587 in dissect_tns_control (tvb=0x83fa6b4, offset=8, 
pinfo=0x83f8120, tree=0x83f7408, tns_tree=0x83f7840) at packet-tns.c:699
#7  0x0814f883 in dissect_tns (tvb=0x83fa6b4, pinfo=0x83f8120,
tree=0x83f7408)
at packet-tns.c:810
#8  0x081c6bda in dissector_try_port (sub_dissectors=0x835f850, port=1521,
tvb=0x83fa6b4, pinfo=0x83f8120, tree=0x83f7408) at packet.c:491
#9  0x0814cc4a in decode_tcp_ports (tvb=0x83fa680, offset=20,
pinfo=0x83f8120,
tree=0x83f7408, src_port=1521, dst_port=40166) at packet-tcp.c:796
#10 0x0814d7d8 in dissect_tcp (tvb=0x83fa680, pinfo=0x83f8120,
tree=0x83f7408)
at packet-tcp.c:1102
#11 0x081c6bda in dissector_try_port (sub_dissectors=0x8351c20, port=6,
tvb=0x83fa680, pinfo=0x83f8120, tree=0x83f7408) at packet.c:491
#12 0x080bbdd1 in dissect_ip (tvb=0x83fa64c, pinfo=0x83f8120,
tree=0x83f7408)
at packet-ip.c:1121
#13 0x081c6bda in dissector_try_port (sub_dissectors=0x834f330, port=2048,
tvb=0x83fa64c, pinfo=0x83f8120, tree=0x83f7408) at packet.c:491
#14 0x0809e3fb in ethertype (etype=2048, tvb=0x83fa618,
offset_after_etype=14,
pinfo=0x83f8120, tree=0x83f7408, fh_tree=0x83f74a8, etype_id=670,
trailer_id=672) at packet-ethertype.c:156
#15 0x0809e1a8 in dissect_eth (tvb=0x83fa618, pinfo=0x83f8120,
tree=0x83f7408)
at packet-eth.c:230
#16 0x081c6bda in dissector_try_port (sub_dissectors=0x834f618, port=1,
tvb=0x83fa618, pinfo=0x83f8120, tree=0x83f7408) at packet.c:491
#17 0x0809f83c in dissect_frame (tvb=0x83fa618, pinfo=0x83f8120,
tree=0x83f7408) at packet-frame.c:143
#18 0x081c750a in call_dissector (handle=0x834f6a8, tvb=0x83fa618,
pinfo=0x83f8120, tree=0x83f7408) at packet.c:955 
#19 0x081c68de in dissect_packet (edt=0x83f8118, pseudo_header=0x833a314,
pd=0x833a3a4 "\b", fd=0x842d0d0, cinfo=0x0) at packet.c:242
#20 0x081c539d in epan_dissect_run (edt=0x83f8118, pseudo_header=0x833a314,
data=0x833a3a4 "\b", fd=0x842d0d0, cinfo=0x0) at epan.c:103
.......


Best Regards
Michal Stekrt

Attachment: bad_frame.snoop
Description: Binary data