[bugzilla-daemon@xxxxxxxxxxxxx]

http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1737

           Summary: emem_tree_lookup32_array can alter the key
           Product: Wireshark
           Version: SVN
          Platform: Macintosh
        OS/Version: Mac OS X 10.0
            Status: NEW
          Severity: Normal
          Priority: Low
         Component: TShark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: luis.ontanon@xxxxxxxxx


Build Information:
wireshark 0.99.7

Copyright 1998-2007 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GTK+ 2.10.7, with GLib 2.12.7, with libpcap 0.9.4, with libz
1.2.3, with libpcre 7.0, with Net-SNMP 5.4, with ADNS, with Lua 5.1, with
GnuTLS
1.4.1, with Gcrypt 1.2.2, without Kerberos, with PortAudio PortAudio V19-devel,
without AirPcap.

Running on Darwin 8.10.0, with libpcap version 0.9.4.

Built using gcc 4.0.0 20041026 (Apple Computer, Inc. build 4061).

found in revision 22486


--
/* after few "odd" lookups and insertions emem_tree_lookup32_array ends up
"corrupting" the key */

/* the following snipplet reproduces the bug */

static emem_tree_t* tree;

void lookup_n_insert( guint32 len, guint32 ints[] ) {
        guint32 x = len;
        emem_tree_key_t key[] = {
                {1,&x},
                {x,(ints)},
                {0,NULL}
        };

        printf("\nbefore lookup key[0].length=%u, key[0].key[0]=%u, 
key[1].length=%u, key[1].key=%u %u %u
%u\n",key[0].length,key[0].key[0],key[1].length,key[1].key[0],key[1].key[1],key[1].key[2],key[1].key[3]);

        emem_tree_lookup32_array(tree,key);

        printf("after lookup key[0].length=%u, key[0].key[0]=%u, 
key[1].length=%u, key[1].key=%u %u %u
%u\n",key[0].length,key[0].key[0],key[1].length,key[1].key[0],key[1].key[1],key[1].key[2],key[1].key[3]);

        emem_tree_insert32_array(tree,key,key);

        printf("after insert key[0].length=%u, key[0].key[0]=%u, 
key[1].length=%u, key[1].key=%u %u %u
%u\n",key[0].length,key[0].key[0],key[1].length,key[1].key[0],key[1].key[1],key[1].key[2],key[1].key[3]);
}                       

void watch_bug(void) {
        guint32 k1[] = {1,2,1,1};
        guint32 k2[] = {1,2,1,2};
        guint32 k3[] = {1,2,1,3};

        tree = pe_tree_create(EMEM_TREE_TYPE_RED_BLACK, "foo-bar");
        lookup_n_insert(4,k1);
        lookup_n_insert(4,k2);
        lookup_n_insert(4,k3);
}


/*

this is the output I get:




before lookup key[0].length=1, key[0].key[0]=4,  key[1].length=4, key[1].key=1
2 1 1
after lookup key[0].length=1, key[0].key[0]=4,  key[1].length=4, key[1].key=1 2
1 1
after insert key[0].length=1, key[0].key[0]=4,  key[1].length=1, key[1].key=1 1
2 1

before lookup key[0].length=1, key[0].key[0]=4,  key[1].length=4, key[1].key=1
2 1 2
after lookup key[0].length=1, key[0].key[0]=4,  key[1].length=1, key[1].key=2 1
2 1
after insert key[0].length=1, key[0].key[0]=4,  key[1].length=1, key[1].key=2 1
2 1

before lookup key[0].length=1, key[0].key[0]=4,  key[1].length=4, key[1].key=1
2 1 3
after lookup key[0].length=1, key[0].key[0]=4,  key[1].length=1, key[1].key=3 0
17091736 3221223216
after insert key[0].length=1, key[0].key[0]=4,  key[1].length=1, key[1].key=3 0
17091736 3221223216
*/


IMHO we should constify the key in tree calls.


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.