Wireshark-bugs: [Wireshark-bugs] [Bug 7885] Buildbot crash output: fuzz-2012-10-21-7332.pcap

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Tue, 18 Dec 2012 02:55:04 +0000

changed bug 7885

What Removed Added
CC   [email protected]

Comment # 5 on bug 7885 from 
Looks like another case of using ep_ memory for addresses:

~~~
==1547== Invalid read of size 1
==1547==    at 0x61240A5: bytes_to_hexstr_punct (to_str.c:140)
==1547==    by 0x60E3962: address_to_str_buf (address_to_str.c:598)
==1547==    by 0x60E3BFD: se_address_to_str (address_to_str.c:532)
==1547==    by 0x60E2387: se_get_addr_name (addr_resolv.c:3005)
==1547==    by 0x60E7104: col_set_addr.isra.0 (column-utils.c:1429)
==1547==    by 0x60EA443: col_fill_in (column-utils.c:1731)
==1547==    by 0x419559: print_packet (tshark.c:3512)
==1547==    by 0x41B066: process_packet (tshark.c:3181)
==1547==    by 0x40DB82: main (tshark.c:2961)
==1547==  Address 0x153eb450 is 0 bytes inside a block of size 8 free'd
==1547==    at 0x4A07786: free (vg_replace_malloc.c:446)
==1547==    by 0x35ACC4D50E: g_free (in /usr/lib64/libglib-2.0.so.0.3200.4)
==1547==    by 0x60EC89B: emem_free_all (emem.c:1239)
==1547==    by 0x60EF3E8: epan_dissect_run_with_taps (epan.c:219)
==1547==    by 0x41ADBE: process_packet (tshark.c:3164)
==1547==    by 0x40DB82: main (tshark.c:2961)
==1547== 
==1547== Invalid read of size 1
==1547==    at 0x61240EA: bytes_to_hexstr_punct (to_str.c:143)
==1547==    by 0x60E3962: address_to_str_buf (address_to_str.c:598)
==1547==    by 0x60E3BFD: se_address_to_str (address_to_str.c:532)
==1547==    by 0x60E2387: se_get_addr_name (addr_resolv.c:3005)
==1547==    by 0x60E7104: col_set_addr.isra.0 (column-utils.c:1429)
==1547==    by 0x60EA443: col_fill_in (column-utils.c:1731)
==1547==    by 0x419559: print_packet (tshark.c:3512)
==1547==    by 0x41B066: process_packet (tshark.c:3181)
==1547==    by 0x40DB82: main (tshark.c:2961)
==1547==  Address 0x153eb451 is 1 bytes inside a block of size 8 free'd
==1547==    at 0x4A07786: free (vg_replace_malloc.c:446)
==1547==    by 0x35ACC4D50E: g_free (in /usr/lib64/libglib-2.0.so.0.3200.4)
==1547==    by 0x60EC89B: emem_free_all (emem.c:1239)
==1547==    by 0x60EF3E8: epan_dissect_run_with_taps (epan.c:219)
==1547==    by 0x41ADBE: process_packet (tshark.c:3164)
==1547==    by 0x40DB82: main (tshark.c:2961)
~~~

I really should go back and read about that stuff; for now, I'll leave this.

You are receiving this mail because:
  • You are watching all bug changes.