["packet steve" <packetsteve@xxxxxxxxxxx>]

Problem seen in both 0.10.9 and latest SVN.
The capture is TCP/IP/GRE(A10)/IP and IP_in_IP, and has some duplicated 
packets.
The failure depends on the setting of tcp.relative_sequence_numbers.

Both ethereal and tethereal are affected.

$ ./tethereal -v
tethereal 0.10.9 (SVN 20050131154051)
Compiled with GLib 1.2.10, with libpcap 0.8.3, with libz 1.1.3, without 
libpcre,
with UCD-SNMP 4.2.6, without ADNS.
NOTE: this build doesn't support the "matches" operator for Ethereal filter 
syntax.
Running with libpcap version 0.8.3 on SunOS 5.8.

Typical message is
GLib-CRITICAL **: file gmem.c: line 748: assertion `mem_chunk != NULL' 
failed


#0  get_tcp_conversation_data (pinfo=0x0) at packet-tcp.c:303
#1  0xfea55ba0 in dissect_tcpopt_sack (optp=0xfef0b490, tvb=0x1e985c, 
offset=34, optlen=10, pinfo=0x1e9458, opt_tree=0x0) at packet-tcp.c:2261
#2  0xfe8d0d30 in dissect_ip_tcp_options (tvb=0x1e985c, offset=34, length=8, 
opttab=0xfef0b418, nopts=312, eol=0,  pinfo=0x1e9458, opt_tree=0x0) at 
packet-ip.c:733
#3  0xfea57980 in dissect_tcp (tvb=0x1e985c, pinfo=0x1e9458, tree=0x0) at 
packet-tcp.c:3013
#4  0xfe6b7d14 in call_dissector_through_handle (handle=0x18fe18, 
tvb=0x1e985c, pinfo=0x1e9458, tree=0x0) at packet.c:366
#5  0xfe6b8118 in call_dissector_work (handle=0x18fe18, tvb=0x1e985c, 
pinfo_arg=0x1e9458, tree=0x0) at packet.c:541
#6  0xfe6b8a74 in dissector_try_port (sub_dissectors=0x0, port=6, 
tvb=0x1e985c, pinfo=0x1e9458, tree=0x0) at packet.c:816
#7  0xfe8d19dc in dissect_ip (tvb=0x1e9828, pinfo=0x1e9458, tree=0x0) at 
packet-ip.c:1098
#8  0xfe6b7d14 in call_dissector_through_handle (handle=0xa2870, 
tvb=0x1e9828, pinfo=0x1e9458, tree=0x0) at packet.c:366
#9  0xfe6b8118 in call_dissector_work (handle=0xa2870, tvb=0x1e9828, 
pinfo_arg=0x1e9458, tree=0x0) at packet.c:541
#10 0xfe6b8a74 in dissector_try_port (sub_dissectors=0x0, port=4, 
tvb=0x1e9828, pinfo=0x1e9458, tree=0x0) at packet.c:816
#12 0xfe6b7d14 in call_dissector_through_handle (handle=0xa2870, 
tvb=0x1e97f4, pinfo=0x1e9458, tree=0x0) at packet.c:366
#13 0xfe6b8118 in call_dissector_work (handle=0xa2870, tvb=0x1e97f4, 
pinfo_arg=0x1e9458, tree=0x0) at packet.c:541
#14 0xfe6b8a74 in dissector_try_port (sub_dissectors=0x0, port=2048, 
tvb=0x1e97f4, pinfo=0x1e9458, tree=0x0) at packet.c:816
#15 0xfe813a14 in ethertype (etype=2048, tvb=0x1e97c0, 
offset_after_etype=14, pinfo=0x1e9458, tree=0x0, fh_tree=0x0,
   etype_id=4408, trailer_id=4410, fcs_len=-1) at packet-ethertype.c:182
#16 0xfe81104c in dissect_eth_common (tvb=0x1e97c0, pinfo=0x1e9458, 
tree=0x0, fcs_len=-1) at packet-eth.c:300
#17 0xfe6b7d14 in call_dissector_through_handle (handle=0x14c460, 
tvb=0x1e97c0, pinfo=0x1e9458, tree=0x0) at packet.c:366
#18 0xfe6b8118 in call_dissector_work (handle=0x14c460, tvb=0x1e97c0, 
pinfo_arg=0x1e9458, tree=0x0) at packet.c:541
#19 0xfe6b8a74 in dissector_try_port (sub_dissectors=0x0, port=1, 
tvb=0x1e97c0, pinfo=0x1e9458, tree=0x0) at packet.c:816
#20 0xfe833bc4 in dissect_frame (tvb=0x1e97c0, pinfo=0x1e9458, tree=0x0) at 
packet-frame.c:189
#21 0xfe6b7d14 in call_dissork (handle=0xa2618, tvb=0x1e97c0, 
pinfo_arg=0x1e9458, tree=0x0) at packet.c:541
#23 0xfe6b8284 in call_dissector (handle=0xa2618, tvb=0x1e97c0, 
pinfo=0x1e9458, tree=0x0) at packet.c:1682
#24 0xfe6b854c in dissect_packet (edt=0x1e9450, pseudo_header=0x1c0fbc, 
pd=0x1d1e50 "", fd=0xffbef228, cinfo=0x1e9458)
   at packet.c:314
#25 0x00023d08 in process_packet (cf=0x697c8, pdh=0x0, offset=397312, 
whdr=0x1c0fa8, pseudo_header=0x1c0fbc, pd=0x1d1e50 "",
   err=0xffbef304) at tethereal.c:2568
#26 0x0002732c in main (argc=432072, argv=0x6) at tethereal.c:2381

The error shifts somewhat depending on which options are used.

looks like
tcpd=g_mem_chunk_alloc(tcp_analysis_chunk);
in packet-tcp.c:303 sees sometimes sees tcp_analysis_chunk as null.