[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7566

           Summary: Capture file that crashes wireshark in
                    packet-dcp-etsi.c
           Product: Wireshark
           Version: 1.8.1
          Platform: x86
        OS/Version: All
            Status: NEW
          Severity: Critical
          Priority: Low
         Component: Wireshark
        AssignedTo: bugzilla-admin@xxxxxxxxxxxxx
        ReportedBy: laurentb@xxxxxxxxx


Created attachment 8892
  --> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=8892
capture triggering the crash

Build Information:
1.8.1
--
Hi,

Here is a PCAP file triggering a crash that could enable a remote party to
trigger (a least) a remote denial of service.

This was successfully tested on 1.8.1.

This file was generated thanks to a fuzz testing campaign.

Laurent Butti.

Program received signal SIGFPE, Arithmetic exception.
0x009ce997 in dissect_pft_fec_detailed (tvb=0x87f5070, pinfo=0xbfffe424,
tree=0xb69145b8) at packet-dcp-etsi.c:273
273      rx_min = c_max*rsk/plen;
(gdb) bt
#0  0x009ce997 in dissect_pft_fec_detailed (tvb=0x87f5070, pinfo=0xbfffe424,
tree=0xb69145b8) at packet-dcp-etsi.c:273
#1  dissect_pft_fragmented (tvb=0x87f5070, pinfo=0xbfffe424, tree=0xb69145b8)
at packet-dcp-etsi.c:405
#2  dissect_pft (tvb=0x87f5070, pinfo=0xbfffe424, tree=0xb69145b8) at
packet-dcp-etsi.c:518
#3  0x00788786 in call_dissector_through_handle (handle=0x8813aa8, tvb=<value
optimized out>, pinfo=0xbfffe424, tree=0xb69145b8) at packet.c:419
#4  0x00788fe9 in call_dissector_work (handle=0x8813aa8, tvb=<value optimized
out>, pinfo_arg=0xbfffe424, tree=0xb69145b8, add_proto_name=1) at packet.c:510
#5  0x0078a1c0 in dissector_try_string (sub_dissectors=0x816d778,
string=0xb757b0a8 "PF", tvb=0x87f5070, pinfo=0xbfffe424, tree=0xb69145b8) at
packet.c:1200
#6  0x009cdca6 in dissect_dcp_etsi (tvb=0x87f5070, pinfo=0xbfffe424,
tree=0xb6914000) at packet-dcp-etsi.c:200
#7  0x0078898e in dissector_try_heuristic (sub_dissectors=0x8749b00,
tvb=0x87f5070, pinfo=0xbfffe424, tree=0xb6914000) at packet.c:1727
#8  0x00f524f9 in decode_udp_ports (tvb=0x87f5038, offset=8, pinfo=0xbfffe424,
tree=0xb6914000, uh_sport=31720, uh_dport=37428, uh_ulen=24)
    at packet-udp.c:281
#9  0x00f52cda in dissect (tvb=<value optimized out>, pinfo=<value optimized
out>, tree=0xb6914000, ip_proto=17) at packet-udp.c:595
#10 0x00788786 in call_dissector_through_handle (handle=0x86cb010, tvb=<value
optimized out>, pinfo=0xbfffe424, tree=0xb6914000) at packet.c:419
#11 0x00788fe9 in call_dissector_work (handle=0x86cb010, tvb=<value optimized
out>, pinfo_arg=0xbfffe424, tree=0xb6914000, add_proto_name=1) at packet.c:510
#12 0x0078a38b in dissector_try_uint_new (sub_dissectors=0x83444a8,
uint_val=17, tvb=0x87f5038, pinfo=0xbfffe424, tree=0xb6914000,
add_proto_name=1)
    at packet.c:935
#13 0x0078a401 in dissector_try_uint (sub_dissectors=0x83444a8, uint_val=17,
tvb=0x87f5038, pinfo=0xbfffe424, tree=0xb6914000) at packet.c:961
#14 0x00ba80f1 in dissect_ip (tvb=0x87f5000, pinfo=0xbfffe424,
parent_tree=0xb6914000) at packet-ip.c:2370
#15 0x00788786 in call_dissector_through_handle (handle=0x8345920, tvb=<value
optimized out>, pinfo=0xbfffe424, tree=0xb6914000) at packet.c:419
#16 0x00788fe9 in call_dissector_work (handle=0x8345920, tvb=<value optimized
out>, pinfo_arg=0xbfffe424, tree=0xb6914000, add_proto_name=1) at packet.c:510
#17 0x0078a38b in dissector_try_uint_new (sub_dissectors=0x8267a80,
uint_val=2048, tvb=0x87f5000, pinfo=0xbfffe424, tree=0xb6914000,
add_proto_name=1)
    at packet.c:935
#18 0x0078a401 in dissector_try_uint (sub_dissectors=0x8267a80, uint_val=2048,
tvb=0x87f5000, pinfo=0xbfffe424, tree=0xb6914000) at packet.c:961
#19 0x00a49f65 in ethertype (etype=2048, tvb=0x87f4fa8, offset_after_etype=14,
pinfo=0xbfffe424, tree=0xb6914000, fh_tree=0xb6914168, etype_id=21582, 
---Type <return> to continue, or q <return> to quit---
    trailer_id=21586, fcs_len=-1) at packet-ethertype.c:270
#20 0x00a4894a in dissect_eth_common (tvb=0x87f4fa8, pinfo=0xbfffe424,
parent_tree=0xb6914000, fcs_len=-1) at packet-eth.c:403
#21 0x00788786 in call_dissector_through_handle (handle=0x8267a28, tvb=<value
optimized out>, pinfo=0xbfffe424, tree=0xb6914000) at packet.c:419
#22 0x00788fe9 in call_dissector_work (handle=0x8267a28, tvb=<value optimized
out>, pinfo_arg=0xbfffe424, tree=0xb6914000, add_proto_name=1) at packet.c:510
#23 0x0078a38b in dissector_try_uint_new (sub_dissectors=0x828b9e0, uint_val=1,
tvb=0x87f4fa8, pinfo=0xbfffe424, tree=0xb6914000, add_proto_name=1)
    at packet.c:935
#24 0x0078a401 in dissector_try_uint (sub_dissectors=0x828b9e0, uint_val=1,
tvb=0x87f4fa8, pinfo=0xbfffe424, tree=0xb6914000) at packet.c:961
#25 0x00a8a859 in dissect_frame (tvb=0x87f4fa8, pinfo=0xbfffe424,
parent_tree=0xb6914000) at packet-frame.c:383
#26 0x00788786 in call_dissector_through_handle (handle=0x828bab0, tvb=<value
optimized out>, pinfo=0xbfffe424, tree=0xb6914000) at packet.c:419
#27 0x00788fe9 in call_dissector_work (handle=0x828bab0, tvb=<value optimized
out>, pinfo_arg=0xbfffe424, tree=0xb6914000, add_proto_name=1) at packet.c:510
#28 0x007891ea in call_dissector (handle=0x828bab0, tvb=0x87f4fa8,
pinfo=0xbfffe424, tree=0xb6914000) at packet.c:1996
#29 0x0078afa2 in dissect_packet (edt=0xbfffe41c, pseudo_header=0x88c5228,
pd=0x88ca9e0 "", fd=0xbfffe548, cinfo=0x0) at packet.c:350
#30 0x00780009 in epan_dissect_run (edt=0xbfffe41c, pseudo_header=0x88c5228,
data=0x88ca9e0 "", fd=0xbfffe548, cinfo=0x0) at epan.c:210
#31 0x0805d90b in process_packet (cf=0x8085300, offset=<value optimized out>,
whdr=0x88c51dc, pseudo_header=0x88c5228, pd=0x88ca9e0 "", 
    filtering_tap_listeners=0, tap_flags=<value optimized out>) at
tshark.c:3074
#32 0x08061503 in load_cap_file (argc=3, argv=0xbfffeb04) at tshark.c:2867
#33 main (argc=3, argv=0xbfffeb04) at tshark.c:1759

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.